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Foreword 


Society and Mobility 


As by clear evidence: We are on the brink of the next mobile revolution. Autonomous 
vehicles will become an element of road traffic. The data needed is provided by cameras 
and sensors, and processed in real time by a computer in fractions of a second. These 
vehicles permanently exchange information with one another and with the transport 
infrastructure. Driving robots are to successively relieve the driver of individual tasks. 

Nonetheless, the technological perspective of autonomous driving is only one aspect of 
many. Autonomous vehicles will also have a direct impact on our society that today we 
can barely imagine. Numerous critical questions arise: What are the prospects concerning 
data security? How shall we deal with wide-ranging interventions in our own mobile 
autonomy? What problems result when an autonomous vehicle crosses national borders? 
In what form will insurance companies assume liability for autonomous vehicles involved 
in accidents in the future? Or, vice versa: Can we continue to leave humans at the wheel at 
all, and may driving robots prove to increase road safety? 

The Daimler and Benz Foundation considers the social dimension of these changes to 
be of at least as great significance as the technological one. Innovative technologies are by 
themselves insufficient to shape these developments and to realize automated driving in 
our society. We are therefore well advised to already start asking ourselves such questions 
today and not simply accept this profound change in our mobility as given, allowing it to 
“overrun” us. To shed light on the ethical, social, legal, psychological, or transport-related 
aspects of this process, the Daimler and Benz Foundation invited researchers from various 
specialist fields to address this topic. 

The project’s core team—Markus Maurer, Barbara Lenz, Hermann Winner, and 
J. Christian Gerdes—identified the most pertinent questions from their point of view. At 
the same time, the four researchers established an international network of renowned 
specialists, who agreed to share their views and experience. The result before us now, a 
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“white paper”, analyzes the developments that can already be seen from an interdisci- 
plinary perspective. It is the preliminary result of a large-scale funded project: Under the 
name “Autonomous Driving— Villa Ladenburg”, it was given a time frame of around two 
years and a budget of 1.5 million euros by the Daimler and Benz Foundation. Our 
declared aim with the present findings is to make available an objective and independent 
source of information. 

To our minds, exploring the topic from an interdisciplinary perspective is indispens- 
able. In the present volume, the authors therefore attempt an initial comprehensive account 
of what we may judge as scientifically assertable at this moment in time. At the same time, 
we must enable potential users of, and others affected by, the still difficult-to-grasp new 
technologies to experience them firsthand. In this way, many people can begin to have an 
idea of what they can expect and what the technology can actually do—and also what it 
will not be able to do. 

It is already becoming clear that three aspects come to the fore. Firstly, ethical ques- 
tions will override all others. Only when autonomously acting vehicles have successfully 
been provided with a kind of ethics in decision making will driving robotics be able to 
assert itself in practice. This is especially true of so-called dilemma situations, in which it 
has to be weighed up, in the case of an unavoidable collision, what behavior will cause the 
least amount of harm to the persons involved both inside and outside the vehicle. A further 
key question to clear up is what legislative consequences could result here (e.g., traffic 
regulations). 

A further matter concerns the performance of machine perception. This comes up 
against various limits: Sensors, cameras, or assembled components degenerate and suffer 
in their reliability over time. Although it is possible to estimate state uncertainties, and 
from this to check machine-perception performance, will failures really be predictable? 
And how could an autonomous machine’s safe state be at all defined under all conceivable 
circumstances? This issue can be summed up even more clearly in one keyword: robo- 
tification. Ultimately, the specific questions addressed here without exception penetrate in 
deeper forms into all areas of everyday life where autonomous machine systems are used. 
Conditions here also need analyzing, and consequences must be anticipated. 

Not least, automated driving can open up completely new opportunities, but also bring 
with it negative aftereffects. A reduction or shifting of parking-space requirements in inner 
cities and an efficient use of road space in flowing traffic would be set against fresh 
suburbanization stemming from alleviated conditions on the urban fringe. 

As befits our Foundation’s purpose, this publication is designed to contribute to the 
anticipation and excitement of future discourse, and in this way is aimed at benefitting 
society as a whole. The book will place a scientific basis in the hands of representatives 
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from politics, science, the media, academia, and the interested public. This provides the 
necessary foundation for an independent and capable examination of the diverse questions 
and conditions of autonomous driving. 


Prof.Dr. Eckard Minx 
President of the Executive Board 


Prof.Dr. Rainer Dietrich 
Member of the Executive Board 
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Introduction 


Markus Maurer 


Autonomous driving is a popular subject of discussion in today’s media and, occasionally, 
a highly emotional one. Proclamations of success from car makers, system partners, and 
companies whose business models stem from other fields continue to fuel the debate. As 
late as 2011, as the “Autonomous Driving—Villa Ladenburg” project (which enabled the 
present volume to be published) was still being defined, we could not foresee how central 
the topic would be in public discourse at the project’s end three years later. 

In line with the objectives of the Daimler and Benz Foundation, the project aims to 
stimulate discussion on a technical topic of great social significance. It would be immodest 
and objectively false to credit growing discussion to this project when, at the same time, 
several leading global firms are using their research and public relations teams to position 
themselves in this forward-looking technological field. Nonetheless, the project influenced 
the public discourse decisively at various points, even if the connection was not imme- 
diately recognizable. 

Indisputably, the Daimler and Benz Foundation has shown excellent and timely 
instincts in launching this project. Precisely because autonomous driving is currently 
receiving so much attention, the present volume’s publishers deem it a good time to 
present as complete an overview of the topic as possible. For this discussion, researchers 
from various disciplines have taken up the task of sharing their viewpoints on autonomous 
driving with the interested public. This has brought many relevant issues into the debate. 

As researchers, this has taken us into unfamiliar territory. We are addressing a spe- 
cialist audience, potential stakeholders and the interested public in equal measure. Of 
course, this book cannot satisfy every desire. For further reading, then, please consult the 
prior articles of the project team in the journals and conference proceedings of their 
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respective specialist fields. The Foundation also plans publications to accompany this 
volume that will summarize this book’s key findings and put them in everyday language. 


1.1 What Is Autonomous Driving? 


Even a quick glance at the current public debate on autonomous driving shows that there 
is no universal consensus on terminology. In order to bring about a certain convergence in 
how the terms of autonomous driving are understood among those involved in the project, 
some definitions were selected in a highly subjective fashion at the beginning of this 
project. These definitions were illustrated with use cases described in-depth (see Chap. 2). 
These definitions are described in all of their subjectivity here. 

For decades, word plays on the word “automobile” have been rife among pioneers in 
the field of autonomous driving [1]. When the car was invented, the formulation of 
“automobile,” combining the Greek autos (“self, personal, independent”) and the Latin 
mobilis (“mobile”) [2] stressed the “self-mobile.” The overriding emotion was joy that the 
driver was mobile without the aid of horses. What this term failed to acknowledge, 
however, was that the lack of horses meant that the vehicle had also lost a certain form of 
autonomy [1]. Through training and dressage, carriage horses had learned for themselves 
(self = Greek autos, see above) to stay within the bounds of simple laws (Greek nomos: 
“human order, laws made by people”). In this sense, horse and carriage had thus both 
achieved a certain autonomy. 

In the transition from horse carriages to automobiles, important obstacle-avoidance 
skills were lost, as undoubtedly was the occasional ability to undertake “autonomous 
missions.” Many a time would horses have brought a carriage home safely even if the 
driver was no longer completely fit for the journey. They would have at least have 
conveyed the vehicle in a “safe state,” eating their fill of grass on the wayside. The 
autonomous automobile aims to recover its lost autonomy and indeed go far beyond its 
historic form. 

A special perception of Kant’s concept of autonomy, as formulated by Feil, came to be 
of importance in understanding “autonomous driving” within the project: autonomy as 
“self-determination within a superordinate (moral) law” [3]. In the case of autonomous 
vehicles, man lays down the moral law by programming the vehicle’s behavior. The 
vehicle must continually make decisions about how to behave in traffic in a manner 
consistent with the rules and constraints with which it was programmed. 

It has to be said that the reaction of experts from diverse disciplines ranged and ranges 
from complete rejection of this definition to carefully considered approval. Independent of 
this, however, it is possible, by reference to the concept of autonomy interpreted and 
understood in these Kantian terms, to point out the direct linkage between technological 
development and ethical considerations. 
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The importance of this definition for engineers comes through clearly in my discus- 
sions with students. Confronted with this definition, engineering students in Braunschweig 
and Munich have in the last ten years come to understand that the development of 
autonomous driving requires them to not only research and develop technology but also to 
implement “moral laws” with utmost consistency. How does an autonomous vehicle 
behave in a dilemma situation, when at least one road user will inevitably be injured in an 
accident? This discussion is explored in greater depth in this book by Patrick Lin and 
Chris Gerdes (see Chaps. 4 and 5). 

To bring engineers and lawyers into agreement, various degrees of assistance and 
automation were defined in a working group drawn from the German Federal Highway 
Research Institute (BASt) [4]. The highest defined degree of automation was named “Full 
Automation”: The fully automated vehicle drives by itself without human supervision. 
Should system performance degrade, the vehicle is autonomously “restored to the system 
state of minimal risk.” From a technical point of view, the greatest challenge lies in the 
complete absence of a human supervisor who knows the system limits, recognizes system 
faults and, where needed, switches the vehicle into a safe state. Fully automated vehicles 
must monitor their own state autonomously, spot potential system faults and performance 
degradations, and then—with a threatened drop in performance—initialize and execute 
the transition to a safe state. Clearly, the safe state takes on a central role in the definition. 
What does a safe state consist of, however, when a fully automated vehicle is moving on 
the highway at 65 miles per hour (or even faster in Germany)? 

Ohl [7] pointedly concluded that the prototypes for autonomous vehicles demonstrated 
on public roads by research institutes, vehicle manufacturers, and IT companies in recent 
decades have only been partially automated in terms of the BASt definition. Safety drivers 
have supervised the automated vehicles; a production-ready safety concept for fully 
automated vehicles has yet to materialize. While there have been successful trips in which 
the safety driver has not had to intervene, to this day we lack evidence of the feasibility of 
journeys on public roads with fully automated vehicles. 

Despite the concerns of some experts mentioned above, autonomous vehicles in the 
present volume are characterized by their “self-determination within a superordinate 
(moral) law” laid down by humans (Kant, as found in [3], see above). They are fully 
automated vehicles in terms of the BASt definitions [4]. 

For reasons of space, it has been decided for this book to forego a narrative history and 
a documentation of the state of research and the technology. Regarding autonomous road 
vehicles, Matthaei et al. [5] have summarized the current state of the art. In Chap. 3, 
Fabian Kréger gives an arresting historical overview of autonomous driving as a visionary 
concept, or as science fiction, chiefly within image-based media. 
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1.2 Autonomous Driving—Drivers Behind the Research 


Research into fully automated vehicles [4] used to be, and still is, driven by a host of 
reasons. Only the most common are given in this section. 

Even though the number of accident deaths in Germany drops nearly annually, the 
estimated worldwide number is occasion enough for a further increase in transport-system 
safety. According to the WHO, 1.24 million people worldwide died in road accidents in 
2010 [8]. In Chap. 17, Thomas Winkle examines the conditions under which the 
accident-prevention impact of automated vehicles can be forecast prior to their being 
launched on the market. 

How much a driver or potential user requires assistance is at the heart of any particular 
vehicle system. Is he or she confronted with an activity that is tiring and kills off any 
pleasure in driving (stop-and-go traffic, long stretches on highways)? Or is he or she 
temporarily unfit to drive, for instance under the influence of medication, too tired or 
simply too inattentive for active driving? Is there a need for assistance because of 
diminished faculties due to illness or old age, or diseased muscles or bones? In these 
cases, a car’s autonomous capability to drive opens up new opportunities for individual 
mobility. 

Fully automated driving [4] offers the greatest potential for optimizing traffic flow. By 
far the most well-known European program of vehicle automation of the last century has 
already indicated this objective: “Programme for a European traffic with highest effi- 
ciency and unprecedented safety” (1987-1994), or “Prometheus” for short [6]. More 
recent projects have demonstrated technical solutions specially designed to increase traffic 
flow. In Chaps. 15, 16, and 19, the authors occupy themselves with autonomous vehicles’ 
potential for improved traffic flow and new vehicle usage concepts. 

The significance of the capability to drive autonomously for commercial vehicles 
merits special attention. Heike Flamig examines what potentialities arise for autonomous 
vehicles in the area of freight transport (see Chap. 18). 

The potential that autonomous vehicles’ rollout holds for a far-reaching reshaping of 
the transport system—indeed the city itself—has not yet been heavily researched. The 
authors of this book’s “Mobility” and “Acceptance” sections illustrate how multilayered 
the changes made possible by introducing autonomous vehicles could be. These potential 
changes can drive, but also inhibit, such an introduction. 


1.3 The Layout of this Book 


Immediately following this introduction, the use cases which contributed to the authors’ 
common understanding of autonomous driving, and which should do the same for readers 
(see above), are elucidated. This is followed by six sections, each overseen by editors with 
specialist knowledge, from whose pens also stem the short introductions preceding each 
section. 
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Fabian Kröger opens the first section on the topic of “Human and Machine” with a 
summary of how autonomous road vehicles have been viewed in public, mostly in the 
media, since work started on vehicle automation almost one hundred years ago. Chris 
Gerdes and Patrick Lin address how autonomous driving is to be assessed under ethical 
considerations, and whether autonomous vehicles can behave ethically. Berthold Farber 
and Ingo Wolf discuss questions of human and machine coexistence. 

The “Mobility” section examines how mobility may be altered by the introduction of 
autonomous vehicles, both generally and in specific aspects. To this end, Miranda 
Schreurs and Sibyl Steuwer give an overview of the political framework. Barbara Lenz 
and Eva Fraedrich examine the potential for new mobility concepts that may result from 
autonomous driving. Sven Beiker outlines various deployment scenarios for fully auto- 
mated vehicles [4]; he also discusses an actual case of them in use. Dirk Heinrichs looks at 
the ramifications and questions for urban development that may arise from autonomous 
driving. Hermann Winner and Walther Wachenfeld take up the question of what impact 
autonomous driving may have on the vehicle concept itself. Rita Cyganski looks into the 
issue of how autonomous vehicles may change demand for mobility and how this can be 
represented in models for transport planning. 

In the “Traffic” section, Peter Wagner and Bernhard Friedrich forecast how autono- 
mous vehicles may affect traffic. Thomas Winkle furthers the discussion on the potential 
safety benefits of assisted, partially, and fully automated vehicles [4]. Heike Flämig 
examines their particular significance for freight transport. Marco Pavone discusses the 
potential of “Mobility on Demand.” 

The “Safety” section tackles basic questions of technical reliability in machine per- 
ception (Klaus Dietmayer), functional safety (Andreas Reschka, Walther Wachenfeld, 
Hermann Winner), and data integrity (Kai Rannenberg). 

In the “Legal and Liability” section, Tom Gasser, Stephen Wu and Bryant Walker 
Smith examine the current legal systems and legal frameworks for autonomous driving in 
both Germany and the USA; Thomas Winkle recommends drawing from the experience 
of liability cases in the development process. 

In the “Acceptance” section, Eva Fraedrich and Barbara Lenz explore questions of 
individual and societal acceptance of automated vehicles. Armin Grunwald investigates 
questions of society’s perception of risk in connection with autonomous driving. Eva 
Fraedrich and Barbara Lenz examine the relationship between today’s car-usage practices 
and attitudes to autonomous driving. David Woisetschläger discusses the economic 
consequences for the traditional car industry and new market players. 


1.4 Work in the Project 


The working methods in the “Autonomous Driving—Villa Ladenburg” project have 
influenced the present book. They are thus briefly sketched out below for the sake of 
transparency. The “motor” of the project was the core team consisting of Chris Gerdes, 
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Barbara Lenz, Hermann Winner, and Markus Maurer. This was supported by the research 
work of Eva Fraedrich, Walter Wachenfeld, and Thomas Winkle, who receive our grateful 
thanks at this point. In the first of the project’s two years—the project ran from October 
2012 to September 2014 in total—over 200 questions relevant to autonomous driving 
were identified among the core team. These questions were the basis for project specifi- 
cation sheets that served as guidelines for this volume’s authors. Three workshops were 
carried out to bring about a common understanding of autonomous driving among the 
participants in the project and share different perspectives from their various specialist 
disciplines. At one of the first workshops, in November 2013 in the Möhringen district of 
Stuttgart, the concept of the project and basic understanding of autonomous driving— 
established via the definitions discussed above and the use cases (see Chap. 2)—were 
introduced and explored. 

At two further workshops in Monterey (February 2014) and Walting (March 2014), the 
authors presented and put forward for discussion their answers to the project specification 
sheets. It is thanks to the discipline, openness, and expertise of the authors that a com- 
prehensive discussion on autonomous driving can be presented in this volume, addressing 
in equal measure the potential and the challenges to society on the path to mass pro- 
duction. In this sense, this book hopes to be a starting point for sustainable research and 
development of autonomous road vehicles. Special thanks are due to all the authors, who 
have involved themselves in this book project with focus, discipline and a willingness for 
interdisciplinary dialogue. 

In the closing phase of this book’s production, the authors were overseen by the editors 
of the individual sections, who took great pains to aid the convergence of the articles 
therein. Editing the sections was among the tasks of the core-team members. Special 
thanks go to Tom Gasser and Bernhard Friedrich, who each took on the editing of a 
section and brought necessary expertise that was not available on the core team. Even 
before it had drawn to a close, the project made a considerable impact on the specialist 
discussion on autonomous driving in Germany and the USA. One particularly positive 
outcome was that many participants in the project have taken part in round table dis- 
cussions on “automated driving” at the initiative of the German Federal Ministry for 
Transport and Digital Infrastructure (BMVI) and its working groups since December 
2013. Project findings thus flowed, and continue to flow, into the reports of the round 
table. The interest of experts and the public became clear in the response to the numerous 
talks, press interviews, and publications carried out in the context of the project. Over the 
duration of the project, considerable adjustments were made in the communications of 
leading vehicle manufacturers and tech companies relating to autonomous driving. It 
cannot be ruled out that the project has already left its first relevant marks here. 

Even though the project itself employed a scientifically clear-cut definition of auton- 
omous driving, some of its findings will be of direct practical relevance for highly 
automated vehicles and even driver assistance systems already in use in today’s pro- 
duction road cars. 
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2.1 Motivation for the Consideration of Use Cases 


Although autonomous driving is characterized (see Chap. 1) by the definition for “fully 
automated” according to BASt [1] as well as the quote by Feil [2] “self-determination 
within the scope of an higher (moral) law”, it is possible to come up with a large variety of 
usage scenarios and specifications for autonomous driving. In order to grasp this variety, 
proxies are sought, which on the one hand make use of distinguishing characteristics, and 
on the other hand describe typical usage scenarios for autonomous driving. In the fol- 
lowing, these will be called use cases for autonomous driving. Besides the nomenclature, 
the use cases are defined by their distinguishing characteristics, so that a common 
understanding can be reached for all writing and reading these book chapters. In addition, 
the use cases are supposed to serve as reference scenarios for further discussion. It is not 
intended to exclude other examples. However it is recommended to use the defined use 
cases to avoid misunderstanding or oversight. The following definitions and assumptions 
can additionally be expanded for the different book chapters with detailed descriptions. As 
for the different book chapters, definitions and assumptions are relevant in different ways. 
For instance the owner relations are less important for a technical point of view than for 
taking a look at the market impact. Thus, definitions and assumptions are to be examined 
critically. Desired results from working with these use cases are a founded change of 
definitions and assumptions as well as possible controversy, which arise in between the 
different topics (different parameter sensitivity). 

The following description of the use cases is structured in 4 sections. Section 2.2, 
general assumptions, describes the limitations and assumptions that are used and are 
supposed to apply for all use cases. Section 2.3 introduces the four selected use cases and 
defines the specific characteristics. Section 2.4 explains the selection and the level of 
detail for the characteristics describing the use cases. Section 2.5, general definitions, 
proposes definitions, which facilitate a unique description of the use cases. 


2.2 General Assumptions 


Besides the characteristics which distinguish the use cases, and which are listed in the 
following section, there are additional attributes, which apply to the chosen use cases as 
well. The following general assumptions describe these attributes. 

Mixed operation: One basic assumption is that the use cases are deployed at the 
considered time in a mixed operation of transportation systems with different levels of 
automation. Road traffic consists of vehicles with all levels of automation ranging from 
“driver-only” to “assisted” to “fully automated”. During the stepwise introduction of 
automation, both human vehicle operation and driving robot operation are equally likely. 


2 Use Cases for Autonomous Driving 11 


Failures: Hardware or software failures can also happen with autonomously driven 
vehicles. However, it is assumed that a vehicle designed according to the state of the art 
(e.g. ISO 26262) is, with regard to the failures mentioned, at least as reliable and safe as 
today’s vehicles. 

Level of detail: The description of the use cases is not a detailed specification. Instead 
of a detailed description of weather conditions, light conditions, road surface conditions 
etc. the following simplification is assumed. The quality as well as the success rate with 
which the driving robot performs the driving task is similar to the human quality and 
success rate. For example, heavy rain leads only to transition to the safe state and dis- 
continuation of the transportation task when a driver would discontinue the journey as 
well. This document does not tackle the question of whether this assumption from the 
user’s point of view, the society’s point of view etc. is sufficient. Furthermore, in this 
document the question of how this quality and success rate is quantified and proved 
remains unanswered. 

Conformity with regulations: For all use cases it is assumed that the autonomous 
journey is performed compliant with the set of rules of the respective jurisdiction 
(federal/national level, state level in the United States), in which the driving actually takes 
place. The question about the action in dilemma situations directly arises from this 
assumption. Is the driving robot permitted, or is it even possible, to disregard rules in 
order to prevent major damage? For these use cases it is assumed that a legally valid set of 
tules, respectively meta-rules, exists, which the driving robot follows. In order to do so, 
the respective authority has granted permission to perform autonomous driving, while it is 
not further contemplated how such permission can be obtained and what the respective 
rules might be. 


2.3 Description of the Use Cases 


The motivations and general assumptions underlying the use cases are laid out above, and 
the characteristics considered for their description are explained in Sect. 2.4. The com- 
bination of these characteristics and/or their values leads to a very large number of use 
cases, which cannot be described in detail. The four use cases described in the following 
serve, as mentioned above, as proxies for this multitude of possible use cases. Other use 
cases are not disregarded but our focus is set on the following four: 


e Interstate Pilot Using Driver for Extended Availability. 

e Autonomous Valet Parking. 

e Full Automation Using Driver for Extended Availability. 
e Vehicle on Demand. 


12 W. Wachenfeld et al. 


The partition of the driving task between human and driving robot, in which the four 
versions differ, has particularly contributed to the selection of the use cases. The first two 
use cases are seen as introductory versions, while the two latter use cases present widely 
developed versions of autonomous driving. 


2.3.1 Interstate Pilot Using Driver for Extended Availability 
An exemplary use case of the interstate pilot is depicted in Fig. 2.1. 


2.3.1.1 Benefit 

The driving robot takes over the driving task of the driver exclusively on interstates or 
interstate-like expressways. The driver becomes just a passenger during the autonomous 
journey, can take his/her hands off of the steering wheel and pedals, and can pursue other 
activities. 


2.3.1.2 Description 

As soon as the driver has entered the interstate, he/she can, if desired, activate the driving 
robot. This takes place most logically in conjunction with indicating the desired desti- 
nation. The driving robot takes over navigation, guidance, and control until the exit from 
or end of the interstate is reached. The driving robot safely coordinates the handover to the 
driver. If the driver does not meet the requirements for safe handover, e.g. because he/she 
is asleep or appears to have no situation awareness, the driving robot transfers the vehicle 
to the risk-minimal state on the emergency lane or shortly after exiting the interstate. 
During the autonomous journey, no situation awareness is required from the occupant; the 
definition for fully automated driving according to BASt [1] applies. Because of simple 
scenery and limited dynamic objects, this use case is considered as an introductory 


Fig. 2.1 Interstate pilot using driver for extended availability 
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scenario, even if the comparatively high vehicle velocity exacerbates accomplishing the 
risk-minimal state considerably. 


2.3.1.3 Values of Characteristics 

Table 2.1 summarizes the characteristics for the interstate pilot use case. Figure 2.2 shows 
the intervention possibilities for instances on the levels of the driving task for the use case 
Interstate Pilot. “The entities which can intervene into the driving task are depicted on the 


Table 2.1 Values of characteristics for interstate pilot using driver for extended availability 


Characteristic Value 
A Type of occupant 3 Person/s with agreed destinations 
B Maximum permitted gross weight 1-3 500 kg to 8t 
C Maximum deployment velocity 4 Up to 120 km/h 
D Scenery 8la Interstate Without permission 
allowed 
E Dynamic elements 2 Only motor vehicles 
F Information flow between driving robot and 1—4 Navigation optimization, guidance 
other entities optimization, control optimization, 
provision of environmental 
information 
G Availability concept 2 Availability through driver 
H _ Extension concept 2 Driver 


= 


Options for intervention 


ee en EA TE a rT E ANS T T 


: Autonomous driving 


Driving mission 


Driving robot 


Fig. 2.2 Interstate pilot options for intervention 


| Safe exit 


Figure 2.2: interstate pilot options 
for intervention 


Recessive 
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right side of the hierarchy and are sorted from dominant at the top to recessive at the 
bottom.” The vehicle user is the only entity which may intervene. It should be emphasized 
again that the handover is managed in a safe manner through the driving robot. Potential 
service providers, police and ambulance with specific authority, a traffic coordinator etc. 
do not have any possibility to intervene with the vehicle control. 


2.3.2 Autonomous Valet Parking 
An exemplary use case of the autonomous valet parking is depicted in Fig. 2.3. 


2.3.2.1 Benefit 

The driving robot parks the vehicle at a remote location after the passengers have exited 
and cargo has been unloaded. The driving robot drives the vehicle from the parking 
location to a desired destination. The driving robot re-parks the vehicle. 

The driver saves the time of finding a parking spot as well as of walking to/from a 
remote parking spot. In addition, access to the vehicle is eased (spatially and temporally). 
Additional parking space is used more efficiently and search for parking is arranged more 
efficiently. 


Fig. 2.3 Autonomous valet parking 
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2.3.2.2 Description 

If a driver has reached his/her destination (for example place of work, gym, or home), he/she 
stops the vehicle, exits, and orders the driving robot to park the vehicle. The vehicle can be 
privately owned, but might also be owned by a carsharing provider or similar business model. 
Therefore, the driving robot may now drive the vehicle to a private, public, or service-provider- 
owned parking lot. It is important to assign a parking lot to the driving robot. The search for the 
respective parking lot by the driving robot is not taken into consideration for this use case. 
Therefore a defined destination for the driving robot is always given. Because of the low 
velocity and the light traffic situation, the deployment of Autonomous Valet Parking is limited 
to the immediate vicinity of the location where the driver left the vehicle. On the one hand, this 
limitation reduces the requirements regarding the (driving-) capabilities of the driving robot 
significantly, because lower kinetic energy as well as shorter stopping distances results from 
lower velocity. On the other hand, this use case could potentially irritate or frustrate other road 
users. However, this use case seems to be suitable as an introductory scenario. 

An authorized user in the vicinity of the vehicle can indicate a pick-up location to the 
driving robot. The driving robot drives the vehicle to the target destination and stops, so 
that the driver can enter and take over the driving task. 

If desired by the parking lot administration, the driving robot can re-park the vehicle. 


2.3.2.3 Values of Characteristics 

Table 2.2 summarizes the characteristics for the autonomous valet parking use case. The 
entities which can intervene into the driving task are depicted on the right side of the 
hierarchy and are sorted from dominant at the top to recessive at the bottom (see Fig. 2.4). 
The vehicle user can change the driving mission from outside of the vehicle and instruct the 
driving robot to perform a safe exit. The service provider overrules the vehicle user and can 


Table 2.2 Values of characteristics for autonomous valet parking 


Characteristic Value 
A Type of occupant 1 No cargo and no person 
B Maximum permitted gross 1-5 500 kg to 8 t 
weight 
C Maximum deployment 2 Up to 30 km/h 
velocity 
D Scenery 3ļa-5| Parking lot or parking structure, Without 
a access roads, built-up main traffic permission 
roads allowed 
E Dynamic elements 1 Without exclusion 
F Information flow between l and Navigation optimization, control optimization 
driving robot and other 3 and monitoring the driving robot 
entities 6 
G Availability concept 1 No availability addition 
H Extension concept 2 Driver 
I Options for intervention Figure 2.4: autonomous valet parking options for 


intervention 
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Fig. 2.4 Autonomous valet parking options for intervention 


also influence the driving mission and the safe exit. Both entities are overruled by the 
entities with exclusive rights. For example, the police or ambulance can decelerate the 
vehicle on the guidance level, change navigation and driving mission, and order a safe exit. 


2.3.3 Full Automation Using Driver for Extended Availability 


An exemplary use case of the full automation using driver for extended availability is 
depicted in Fig. 2.5. 


2.3.3.1 Benefit 

If the driver desires to do so, he/she hands over the driving task to the driving robot in 
permitted areas. The driver becomes just a passenger during the autonomous journey, can 
take his/her hands off of the steering wheel and pedals, and can pursue other activities. 


2.3.3.2 Description 
If the driver desires, he/she can always hand over the driving task to the driving robot, 
whenever the current scenery is cleared to do so. Almost the entire traffic area in the 
permitted country is approved for the vehicle; however, such approval is subject to 
restrictions. If, for instance, the traffic flow is rerouted, a new parking structure opens, or 
similar changes are undertaken to the infrastructure, then the respective areas cannot be 
navigated autonomously until further approval. It also appears to be reasonable in this 
scenario that road sections are excluded from approval permanently or temporarily, e.g. 
roads with a high frequency of pedestrians crossing. Here again, the handover between 
driver and driving robot has to be managed in a safe manner. 

This use case might come as close as it gets to today’s visions for autonomous driving, 
as it corresponds strongly with today’s passenger vehicle usage, and the driving task is 
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Fig. 2.5 Full automation using driver for extended availability 


almost completely delegated to the driving robot while the traditional main user and driver 


still participate in the journey. 


2.3.3.3 Values of Characteristics 


Table 2.3 summarizes the characteristics for the full automation using driver for extended 
availability use case. Figure 2.6 shows, which entity (right) intervenes with a certain 
driving task (left) on a certain level. If desired, the vehicle user can drive the vehicle the 


Table 2.3 Values of characteristics for full automation using driver for extended availability 


Characteristic 

A Type of occupant 

B Maximum permitted 
gross weight 

C Maximum deployment 
velocity 

D Scenery 

E Dynamic elements 

F Information flow 
between driving robot 
and other entities 

G Availability concept 

H Extension concept 

I Options for intervention 


N 


Value 

Person/s with agreed destinations 

500 kg to 2 t 

Up to 240 km/h 

Non-standardized road, parking lot or Only with 
parking structure, access roads, built up permission 
main traffic roads, urban arterial road, allowed 


country road, interstate 
Without exclusion 


Navigation optimization, guidance optimization, control 
optimization, provision of environmental information, 
updating the driving robot’s capability, monitoring the 
driving robot 

Availability through driver 

Driver 

Figure 2.6: full automation using driver for extended 
availability options for intervention 
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Fig. 2.6 Full automation using driver for extended availability options for intervention 


same way as driving a classic driver only automobile, provided that the driving task has 
been handed over safely from the driving robot. Furthermore, the vehicle user can intervene 
on the level of the navigation, guidance and control tasks. The vehicle user dominates the 
entities with exclusive rights. The vehicle user can therefore overrule police or ambulance, 
which can exclusively intervene on the guidance level. The same is true for the service 
provider. The service provider can intervene on the navigation and guidance level, as long 
as not overruled by the vehicle user. It is left open in this document for which services the 
service provider needs access. Some concepts propose services where the service provider 
takes over the navigation for commercial use and partly pays for fuel and travel expenses. 


2.3.4 Vehicle on Demand 
An exemplary use case of the vehicle on demand is depicted in Fig. 2.7. 


2.3.4.1 Benefit 

The driving robot drives the vehicle autonomously in all scenarios with occupants, with 
cargo, but also completely without any payload. The driving robot makes the vehicle 
available at any requested location. Passengers use the travel time completely indepen- 
dently for other activities than performing the driving task. The cabin is designed com- 
pletely independently from any restrictions of a driver workplace whatsoever. Cargo can 
be transported with the aid of the driving robot continuously for 24 h a day, as long as it is 
not restricted by the energy supply for driving. 
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Fig. 2.7 Vehicle on demand (scenery marked red is not part of the operating area) 


2.3.4.2 Description 

The driving robot receives the requested destination from occupants or external entities 
(users, service provider, etc.), to which the vehicle proceeds autonomously. Humans do 
not have any option to take over the driving task. The human can only indicate the 
destination or activate the safe exit, so that he/she can exit the vehicle safely as quickly as 
possible. With this driving robot, a wealth of different business models is conceivable. 
A mix of taxi service and car sharing, autonomous cargo vehicles or even usage models 
that goes beyond the pure transportation task. One example could be a vehicle for social 
networks that uses information from the network directly in order to plan routes, match 
people or enables further services which have not yet been thought of. 


2.3.4.3 Values of Characteristics 

Table 2.4 summarizes the characteristics for the vehicle on demand use case. The pos- 
sibilities for intervention regarding the use case vehicle on demand are especially broad 
(see Fig. 2.8), due to the enormous (driving) abilities of the driving robot. The driving 
robot always carries out the control level. An entity with exclusive rights (e.g. police or 
ambulance) and the entity for traffic management can both intervene on navigation and 
guidance levels. Vehicle users and service providers can influence the safe exit and 
therefore instruct the driving robot to a fast and safe stop in order for a passenger to leave 
the vehicle. It is especially noticeable that service providers and the authority with 
exclusive rights can overrule the vehicle user. If one authority overrules the user, he/she 
cannot perform the safe exit anymore and has to stay in the vehicle. This constellation is 
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Table 2.4 Values of characteristics for Vehicle on Demand 


Characteristic Value 
A Type of occupant 1-4 No cargo and no person, for transportation approved cargo, 
person/s with agreed destinations, persons with non-agreed 
destinations 
B Maximum 1-3 From 500 kg to 8t 
permitted gross 
weight 
C Maximum 4 Up to 120 km/h 
deployment 
velocity 
D Scenery 2la-8la Non-standardized road, parking lot or parking Without 
structure, access roads, built up main traffic permission 
roads, urban arterial road, country road, allowed 
interstate 
E Dynamic elements 1 Without exclusion 
in the scenery 
F Information flow 1-8 Navigation optimization, guidance optimization, control 
between driving optimization, provision of environmental information, updating 
robot and other the driving robot’s capability, monitoring the driving robot, 
entities monitoring occupants, occupant emergency call 
G Availability 3 Tele-operated driving 
concept 
H Extension concept 1 No substitute 
I Options for Figure 2.8: vehicle on demand options for intervention 
intervention 


| 

| Road traffic authorities 
| 
| Control 


Vehicle manufacturer 


Fig. 2.8 Vehicle on demand options for intervention 
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similar to that of current taxi concepts. The taxi driver can stop as fast as possible, if the 
passenger so requests. Generally though, he (the taxi driver) also has the possibility to 
disregard this request and drive the vehicle as he/she own desires. 


2.4 Selected Characteristics to Describe the Use Cases 


In this section, the characteristics describing the use cases and their values are explained in 
more detail. Besides the following few technical characteristics of autonomous driving, it 
is possible to define further distinguishing attributes, for example regarding the business 
model or market position. This will be disregarded for now because of the as-yet little 
knowledge in this area. 

The characteristics, in alphabetical order A to I, were derived from the 
three-level-model for the driving task according to Donges [3] and chosen for the 
description. In that model, the driving task is divided into the three levels navigation, 
guidance, and control. 


2.4.1 Characteristic A: Type of Occupant 


2.4.1.1 Motivation 

For today’s individual mobility with a vehicle, a human is required to be permanently in 
the vehicle and to control it under all circumstances [4]. This constraint could change with 
the automation of the driving task. Thus the vehicle concept and the safety concept depend 
on the type of occupant. 


2.4.1.2 Values of the Characteristic 
Here, the following values are distinguished: 


. no cargo and no persons, therefore no specific occupant or cargo protection interests 
. cargo approved for transportation 

. person/s with agreed destinations 

. persons with non-agreed destinations. 


BRWN Re 


One use case can be covered by several values of this characteristic. The distinction 
between value 3 and 4 is made in order to distinguish between individual and public 
transportation. A vehicle of individual transportation carries persons with agreed desti- 
nations. In contrast, a vehicle of public transportation carries multiple persons who have 
not previously agreed upon a destination. However, persons reach their destinations with 
public transportation, because a schedule with destinations and intermediate stops is 
established. 
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2.4.2 Characteristic B: Maximum Permitted Gross Weight 


2.4.2.1 Motivation 

The maximum permitted gross weight influences safety considerations via kinetic energy. 
Besides safety considerations, looking at gross weight extends the discussion beyond 
individual transportation to public transportation, freight transportation as well as road 
infrastructure. In addition, this characteristic addresses the question of vehicle types, 
which potentially are not compatible with current vehicle types because of the autono- 
mous driving functions and changing requirements, on a high level. Instead of considering 
the boundaries of often country-specific vehicle classes, four mass attributes are chosen. 
They range in values from ultra-light vehicles to heavy trucks and each step spans a factor 
of 4 between types. 


2.4.2.2 Values of the Characteristic 

Discrete distinctions have been established in order to describe the imagined use cases and 
to roughly categorize their mass. An exact determination of the mass is possible for 
existing use cases and specified deployment. Characteristic B covers the following values: 


ultra-light vehicles around 500 kg 
passenger vehicle around 2 t 

light commercial trucks and vans around 8 t 
trucks around 32 t. 


a a 


2.4.3 Characteristic C: Maximum Deployment Velocity 


2.4.3.1 Motivation 

The characteristic of maximum deployment velocity (to be precise the square of the 
velocity) determines, multiplied with the mass, the kinetic energy of a vehicle, and 
therefore also needs to be distinguished. In addition, stopping distance is calculated using 
the square of the velocity. Accordingly, the autonomous system’s requirements regarding 
a risk-minimal state in case of failure or when reaching functional limitations grow with 
the velocity squared. 

Besides safety considerations, travel time and the range achievable in a given time at a 
given deployment velocity are also values that influence individual mobility. In addition, 
the deployment velocity directly defines the road type which can be used if a minimum 
velocity is required for using it. 
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2.4.3.2 Values of Characteristic 

The maximum deployment velocity, characteristic C, has five proxy values, one for 
walking speed, and four in steps with a factor of two (= factor 4 in terms of kinetic energy 
and stopping distance). For concrete use cases the values and regulations need to be 
adapted to the respective deployment. Discrete distinctions have been established in order 
to describe the imagined use cases and to roughly categorize their velocity. An exact 
determination of the velocity is possible for existing use cases and defined deployments. 


1. up to 5 km/h 

2. up to 30 km/h 
3. up to 60 km/h 
4. up to 120 km/h 
5. up to 240 km/h. 


2.4.4 Characteristic D: Scenery 


2.4.4.1 Motivation 

Which spatial areas accessible to the driver through the driver-only automobile will also 
be made accessible with the described use case of autonomous driving? The scenery 
characteristic describes the spatial deployment in which the vehicle drives autonomously. 
For instance, do standardized structures exist, how many lanes are available, and do other 
markings exist? 

Even static scenery can be diverse and present a challenge for the driving robot. One 
example of this, as is often mentioned, is traffic lanes covered with snow, or traffic signs 
hidden by bushes or trees. Such conditions, which are potentially unknown and 
non-changeable at the beginning of a journey, will not be considered with this charac- 
teristic. Determining the extent to which the driving robot can deal with scenery and 
conditions rests on the assumption that the robot can accomplish the driving task as well 
as a human driver. 

This characteristic therefore describes scenarios that are predictable and that follow 
existing rules on a high level (location, environment and function of the road). 


2.4.4.2 Values of the Characteristic 
Dimension: type of scenery 


1. off-road terrain 

2. agricultural road 

3. parking lot or parking structure 
4. access road 
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. main traffic roads 
. urban arterial road 
. country road 

. interstate 

. special areas. 
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The scenery characteristic in its first dimension covers 9 values (the scenery types from 
the German guidelines for integrated network design [5] were expanded) (Table 2.5): 

Besides this value that describes the scenery within which a specific use case can be 
performed, the characteristic has a second dimension, which is the condition whether access 
to the scenery has to be permitted explicitly or not. The respective values are the following: 


a. Without permission allowed: All sceneries of this kind are permitted for driving robot 
operation. 

b. Only with permission allowed: Only selected and permitted sceneries of this kind 
permit a driving robot to operate autonomously in this area. 


For now, it is left open who grants this permission and whether that is a private or 
public administration. In that sense, the type of permission is not further specified, for 
example the infrastructure could be in maintenance mode or a map could be provided, 
enriched with additional information. And also, the permission could include a temporary 
component and statistical or dynamic cutoff times for specific scenery areas. 


Table 2.5 Scenery values description 


Value Description 
Terrain (off-road) — Without standardized or known structures such as lanes or other 
markings 


— Without apparent traffic coordination 
— Not paved for driving 


Agricultural road — Covers rural roads and similar roads with mainly simple pavement 
— Is public 
— Respective traffic rules (e.g. StVO in Germany) apply 
Parking lot or parking - Explicitly designated and marked for parking vehicles. Markings are 
structure not always present for lanes, but standardized marking of the area for 
the coordinated parking of vehicles exist 
— Especially in urban areas, parking structures with several levels have 
at times narrow ramps and little space for maneuvering 
— Respective traffic rules (e.g. StVO in Germany) apply 
(continued) 
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Table 2.5 (continued) 


Value Description 

Access road — Developed roads within developed areas, which primarily serve 
direct access to the developed properties or serve for general 
accommodation 
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— Access neighborhoods characterized by residential, commercial and 


business 


— Generally single lanes and connected by intersections without traffic 


lights 


— Connection with developed main traffic roads, are realized through 


intersections with or without traffic lights or roundabouts 
— In special cases they serve public transportation 
— Mainly open and used by inner-community bike traffic 
— Respective traffic rules (e.g. StVO in Germany) apply 


Urban arterial road — Roads without direct connections or within developed areas 
— Generally serve a connecting function (connection roads) 


— Widely spaced buildings often characterize the sides of these roads 
with facilities for tertiary use, which is why the development remains 


low 


— The roads are single or double lane, which are mainly connected by 
intersections with traffic lights or roundabouts to the remaining road 


network 
— Respective traffic rules (e.g. StVO in Germany) apply 


Country road — Include single lane roads situated outside developed areas 


— Includes also short road sections with two lanes, which are single lane 


roads in the regular case 

— Connection with roads of the same category is generally realized 
through intersections or interchanges of different kinds 

— Respective traffic rules (e.g. StVO in Germany) apply 


Interstate — Include non-developed, two-lane roads that are connected with 
interchanges of different kinds 


— Run outside, in the perimeter of, or within developed areas and are 


exclusively used by fast road traffic 
— Access only possible by special connecting elements like onramps 
— Respective traffic rules (e.g. StVO in Germany) apply 


Special areas — Not open to the public 
— Their geometry is unknown 
— General public traffic rules (e.g. StVO in Germany) do not apply 
— For example an extensive private terrain or industrial facility both 
indoor and outdoor 


— The area can have additional infrastructure for autonomous driving, 


such as a container port with autonomous systems for loading and 
unloading as well as commissioning 
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2.4.5 Characteristic E: Dynamic Elements 


2.4.5.1 Motivation 

Besides the scenery, the complexity of a scene depends largely on dynamic elements. The 
dynamic elements in the scene with the autonomously driving vehicle extend the 
requirements on the driving abilities of the driving robot. Therefore this characteristic 
describes to what extent the use case can be deployed in the current traffic situation and if 
limitations or exclusions for the dynamic elements are considered. 


2.4.5.2 Values of the Characteristic 
Four values of the characteristic are distinguished (Table 2.6): 


. without exclusion 

. only motor vehicles 

. only autonomously driving vehicles 
. no other dynamic elements. 


AUNE 


The exclusion of other dynamic elements for the values 2—4 is not determined in an 
absolute way. The scene on a contemporary interstate is described for instance through 
value (2) only motor vehicles. However, while the situation that one person or cyclist steps 
on the interstate applies in theory, it is disregarded here due to the respective probability of 
occurrence. According to the assumption in Sect. 2.2 that most likely there will be a 
mixed operation, only the values 1 and 2 will be used for the use cases. 


Table 2.6 Dynamic elements values description 


Value Description 
Without exclusion — The most complex scene 
— Animals, pedestrians, cyclists, vehicles, law enforcement, etc. meet 
the autonomously driving vehicle in the scene 
Only motor vehicles — Interaction of autonomous vehicles and human controlled motor 
vehicles 
— Animals, pedestrians, cyclist etc. are excluded 
Only autonomously — A scenery exclusive for autonomously moving vehicles 
driving vehicles 
No other dynamic — Area exclusive for ONE autonomously driving vehicle 
elements 
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2.4.6 Characteristic F: Information Flow Between the Driving 
Robot and Other Entities 


2.4.6.1 Motivation 

As described in Sect. 2.5, the driving robot carries out the tasks of perception, cognition, 
behavior decision and behavior execution. To do so, information about the state of the 
vehicle driven by the robot is required, such as position and velocity, but also information 
about the environment and occupants. This information is derived either from sensors, 
reading from memory systems, or through communication. How and which information is 
exchanged between the driving robot and respective entities is defined by the purpose of 
the information flow. In order to describe the information flow for one use case, the 
purposes of information exchange are assigned to the use cases. 

The availability of the information, its transmission, and the communication partner all 
have to be suitable for the deployment purpose. As already mentioned, it is additionally 
assumed that the technology is only introduced onto the market slowly. Therefore not all 
dynamic elements in the vicinity are able to participate in the information exchange, so 
that a mixed operation has to be assumed. 

The information flow of the driving robot considered herein is a subset of the entire 
information flow of the vehicle. We shall for the moment disregard purposes that are part 
of infotainment and convenience systems. Current news, access to social networks, or 
music streaming may as specific services increase the additional benefit of the autonomous 
journey; however, the information flow of these services is not primarily relevant for 
autonomous driving. Therefore only purposes impacting traffic safety, traffic efficiency, as 
well as purposes that are potentially prerequisites for the autonomous journey, are 
described as distinguishing attributes. 


2.4.6.2 Values of the Characteristic 
Eight purposes of the information flow are distinguished (Table 2.7): 


. Navigation optimization 

. path-tracking optimization 

. control optimization 

. provision of environmental information 
. updating the driving robot’s capability 
. monitoring the driving robot 

. Monitoring occupants 

. occupant emergency call. 
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The first three values might also lead to interactions to negotiate the temporal or spatial 
usage of the traffic infrastructure. For now this interaction is disregarded. 
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Table 2.7 Information flow between driving robot and other entities values description 


Value 


Navigation optimization 


Path-tracking optimization 


Control optimization 


Provision of 
environmental information 


Updating the driving 
robot’s capability 
Monitoring the driving 
robot 


Description 


— Information such as current position, route destination, flow 


velocity, weather, etc. are exchanged with an inter-regional 
traffic center. Inter-regional in this context means that the 
information relevant for navigation lies within the coverage area 
(several hundred kilometers) of the traffic central unit 

Goals of the optimization are, for example, low energy 
consumption and CO>-emission, a travel time or travel distance 
that is as short as possible 


Extensive information about the state (x, v, a, ...) and intention 
of the vehicle driven by a robot as well as information of the 
vehicles in the immediate vicinity are exchanged 

Information regarding weather, road condition, congestion, road 
closures, and phase timing of traffic lights are shared with a local 
traffic center. Local in this context means a coverage area of a 
few kilometers around the vehicle 

The goal is, for example, synchronized drive in lateral as well as 
longitudinal directions (platooning, intersections without signage, 
or adaptive lanes...) 


The vehicle states selected and the intentions of the driving 
robot, road users, and further elements in the immediate vicinity 
of the vehicle are exchanged 

The goal is collision avoidance in lateral and longitudinal 
direction with one or several vehicles in the immediate vicinity, 
according to already existing V2X concepts 


Information about the vehicle environment, which is perceived 
by the driving robot, is shared with road users as well as with a 
traffic center in the immediate vicinity 

The goal is to serve an optimized map with information as a 
source for positioning, hazard recognition, navigation, etc. 


The manufacturer provides an update, which improves the 
(driving-) capabilities of the driving robot 

Information about the status, capabilities, and intentions of the 
driving robot are shared with authorized entities 

The goal is to secure evidence (event data recording) to 
reconstruct the course of an accident, similar to a black box in 
aviation 


— Malfunctions and hazardous situations that are identified through 


self-diagnosis are transmitted to the manufacturer 
(continued) 
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Table 2.7 (continued) 


Value Description 


Monitoring occupants — Information (video, audio, heart rate...) about the occupant, 
which characterize his/her condition, are shared with an 
emergency call center or a service provider 

— The goal is to monitor the health and safety of the occupant 
— Information will be forwarded to authorized receivers without the 
intention and action of the occupant 


Occupant emergency call — If the occupant experiences an emergency related either to him-/ 
herself or the autonomous journey, it is possible to contact an 
emergency call center or the service provider of the autonomous 
journey 

— Occupant initiates contact and shares information voluntarily 


2.4.7 Characteristic G: Availability Concept 


2.4.7.1 Motivation 

During normal operation the driving robot controls the vehicle within the permitted area. 
If the driving robot reaches a generally non-predictable functional limitation, the driving 
robot hands over to a specified availability concept. This availability concept defines how 
to continue the driving mission. Such functional limitations can be unknown obstacles on 
the road, which no longer permit a continuation within the autonomy of decision-making. 
An example for such an obstacle is a branch extending to the road, so that the vehicle 
needs to touch the branch in order to continue the journey. The extent to which the 
availability concept takes over the entire driving task, or just takes over the 
decision-making, is left open intentionally. 


2.4.7.2 Values of the Characteristic 
The following availability concepts are distinguished (Table 2.8): 


. no additional availability 
. availability through driver 
. tele-operated driving 

. pilot service 

. electric towing. 
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The handover from the driving robot to the alternative availability concept is to be 
implemented risk-minimally. The driving robot transfers the vehicle for the handover to 
that risk-minimal state which is suitable for the transfer to the availability concept. 

The respective interfaces for the availability through driver, remote control, a pilot, or 
towing need to be available. 
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Table 2.8 Availability concept values description 


Value Description 

No availability — The driving robot waits until, through external influence, the scene 

addition becomes negotiable again and is covered by the specification of the 
driving robot 

Availability — One occupant supports the driving robot negotiating the scene 

through driver — Left open as to whether this is by taking over the driving task or through 
maneuver commands 

Tele-operated — A service provider supports the driving robot negotiating the scene via 

driving remote control 

Pilot service — An especially trained person proceeds to the vehicle and supports the 


driving robot negotiating the scene 


Electric towing — If the hardware necessary for the control task is operational, a tow 
vehicle with a direct connection can operate it in order to support the 
driving robot in negotiating the scene 


2.4.8 Characteristic H: Extension Concept 


2.4.8.1 Motivation 

Not necessarily all areas necessary for the transportation task will be covered with the help 
of autonomous driving, especially not at the beginning of its introduction. Subdomains 
will remain which cannot be controlled autonomously. Nevertheless, in order to fulfill the 
mobility needs of customers, portions outside the regime of automated driving can be 
covered with extension concepts. The extension concept describes whether and with what 
aid it becomes possible to perform the vehicle control outside the area specified for 
autonomous driving. 


2.4.8.2 Values of the Characteristic 
Characteristic H has 5 values (Table 2.9): 


1. No substitute beyond the operating area, i.e. the autonomous driving area covers the 
specified transportation tasks completely. The vehicle with this value is an 
exclusive-autonomous vehicle. If the deployment also covers the entire deployment of 
current vehicles, it is a fully autonomous vehicle. 

Driver: A human takes over the driving task. 

Tele-operated driving: The driving task is performed by an external operator. 

Pilot service: An especially trained person takes over the driving task in a specific regime. 
Extra transportation device: At the boundaries of deployment, the driving robot 
coordinates the handover of the vehicle to an extra transportation device so that this 
transportation device can continue the transportation task. Possible examples would be 
the long-distance transport of urban vehicles with the help of a road train or a concept 
similar to an electronic tow-bar. 
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Table 2.9 Extension concept values description 


Value Description 


No substitute — There is no substitute beyond the operating area, i.e. the autonomous 
driving area covers the specified transportation tasks completely. The 
vehicle with this value is an exclusively autonomous vehicle 

— The deployment also covers the entire deployment of current vehicles, it 
is a fully autonomous vehicle 


Driver — A human takes over the driving task 

Tele-operated — The driving task is performed by an external operator 

driving 

Pilot service — An especially trained person takes over the driving task in a specific 
regime 

Extra transportation - At the boundaries of deployment the driving robot coordinates the 

device handover of the vehicle to an extra transportation device so that this 


transportation device can continue the transportation task 

— Possible examples would be the long-distance transport of urban 
vehicles with the help of a road train or a concept similar to an electronic 
tow-bar 


If the driver is considered (the driver value), it is inevitably necessary that a vehicle 
control interface (driver workplace) is available. In addition it is assumed that a capable 
person holding a driver’s license is an occupant for the journey outside the autonomous 
driving area. For other cases, values that are futuristic from today’s perspective (tele- 
operated driving as well as pilot service), a necessary service/interface needs to be pro- 
vided for these alternatives. 


2.4.9 Characteristic I: Options for Intervention 


2.4.9.1 Motivation 

According to Donges [3], the three primary driving tasks of navigation, guidance, and 
stabilization need to be fulfilled in order to guide a vehicle to the desired destination of the 
journey. Löper and Flemisch [6] as well as others replaces stabilization by the term 
control. The task of control covers the stabilization and in addition vehicle control in si- 
tuations of vehicle-dynamics instability. Therefore, the primary driving tasks will be 
navigation, guidance, and control. 

According to the definition of fully automated driving, this driving task is transferred 
completely to the driving robot. When a destination is indicated to the driving robot, it 
fulfills the navigation, guidance, and control tasks and guides the vehicle to the desired 
destination. Although the driving robot will execute these tasks, the internal system 
architecture is not necessarily structured in such a way. 

In contrast, with the exception of hazardous situations (electronic stability control, 
anti-lock braking system, automated emergency braking), the driver is in control of 
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current production vehicles (overwrite capability). The human fulfills the driving tasks at 
the driver workplace in the vehicle. Thus he/she currently has the option to correct the 
actions of assistance systems, i.e. to override them. 

Therefore there are two entities, the occupant as well as the driving robot, which 
basically have the capability to control the vehicle. 

In addition, ideas and concepts for remote vehicle operation (tele-operated) exist, in 
which entities external to the vehicle intervene in the vehicle guidance. If a communi- 
cation link as well as a respective interface for the world outside of the vehicle exists, 
these external entities also have the capability to influence the vehicle control. Therefore, 
in total three groups of entities—internal, vehicle, and external—can be distinguished 
which can intervene with the vehicle control during the autonomous journey. 

To simplify the description of this characteristic, the occupants (adults, minors, people 
with limiting disability etc.) are summarized as the internal group. Influences outside the 
vehicle (law enforcement (e.g. police), registered vehicle owners (if not part of internal 
group), authorized agents etc.) are summarized as the external group. 

If the entities are considered independently, the following questions regarding their 
options for intervention apply: 


1. On which level of vehicle control does the entity have the option to intervene? 
2. For which level of vehicle control does the entity have the authorization to intervene? 


The first is answered via the vehicle concept of the use case. If the entity is supposed to 
have the option for intervention, an appropriate interface in the vehicle concept is pro- 
vided to the entity. 

The second question requires a statutory rule that defines which authorization is assigned 
to entities according to their properties and responsibilities. At this point it will not be further 
elaborated who sets and checks these rules, whether there is a driving test of some sort for the 
different levels, and if authorizations such as a driver’s license or access codes are needed. 

From this, the following combinations of options for interventions that the vehicle 
provides and the authorization for intervention that the entity possesses result: 


a. The vehicle concept offers the option for intervention on one of the three levels 
(navigation, guidance and control) and the entity is authorized to intervene on the same 
level of the driving task. Therefore the entity can intervene. 

b. The vehicle concept offers the option, but the entity is not authorized to intervene on 
one level. This situation correlates to a child that is in the driver’s seat. For the use 
cases, it is assumed for this situation that the law for this situation regulates the 
intervention by the entity. 

c. The vehicle concept does not offer the option, but the entity is authorized to intervene 
on one level. This correlates to a driver in the back seat, who cannot intervene. 

d. The use case offers the option on one level, however the entity is authorized to 
intervene on a different level of the driving task. Also with this combination, the 
intervention is not permitted to the entity. 
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Fig. 2.9 Driving task conflict of interventions between entities 


Only with combination (a) can the driving robot be influenced and/or overruled by the 
entity on one level of the driving task. 

For the description of the use cases it follows that those entities are listed for which at 
least one authorization matches one available option of the vehicle concept. 

In addition, it is assumed that statutory regulation will punish and therefore preclude 
misuse. This assumption also applies to current vehicle concepts. For example, it is not 
technology that prevents children from driving a vehicle, but rather the respective statu- 
tory regulation in combination with required supervision. 

If the entities are now considered simultaneously and the entities are therefore able to 
act simultaneously on the three levels, the third question applies. 


3. Which entity is dominant and how is the hierarchy of the entities defined in case of a 
conflict because of simultaneous interventions (Fig. 2.9)? 


In order to answer this question for the description of the use cases, the intervention of 
the entities has to be attributed with a certain hierarchy. Which entity dominates others 
and thereby decides the vehicle behavior on the different levels of the driving task? A 
hierarchy of the entities needs to be implemented in the vehicle design. 

In this it needs to be acknowledged that, in addition to the hierarchy of the entities, 
there also needs to be a hierarchy of the levels for the driving task. Control always 
overrules guidance and guidance always overrules navigation. Therefore it is additionally 
defined that internal or external entities can intervene only on one level. The entity with 
the highest priority suppresses other interventions. 

Through autonomous driving it is also possible to exclusively transport persons who 
are not able to perform the driving task or to change the driving mission. However, in 
order to provide occupants with the option to exit safely as fast as possible, the safe exit is 
introduced as a special driving mission. If the occupant gains access to the safe exit with 
the highest priority, he/she might not necessarily be able to change the destination of the 
journey, but can exit the vehicle as fast as possible. 
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2.5 General Definitions 


Some basic terms, which will be used in the following sections, are defined as follows: 
navigation—according to Donges [3], navigation includes choosing an appropriate 
driving route from the available road network as well as an estimation of the expected 
time requirement. If there is information about current interferences, such as accidents, 
road works or traffic jams, a change in route planning may be necessary. 
guidance—according to Donges [3], the task of guidance is basically to derive the 
advisable command variables, such as the intended track and the set-point speed, from the 
road situation ahead as well as from the planned route. Part of the guidance is also to 
anticipatorily intervene the open-loop control to create favorable conditions for the lowest 
possible deviations between set and actual values. 

stabilization (control)—to fulfill the stabilization task, according to Donges [3], the 
driver has to ensure with corrective actions that the deviations in the closed-loop control 
are stabilized and compensated to a level for which the driver is capable of handling. 
driver only—ground (0) level of automation according to BASt [1]: “the driver contin- 
uously (throughout the complete trip) accomplishes longitudinal (accelerating/braking) 
and lateral (steering) control.” 

assisted—the first (1) level of automation according to BASt [1]: “the driver continuously 
accomplishes either lateral or longitudinal control. The other/remaining task is accom- 
plished by the automating system to a certain level only. 


e The driver must permanently monitor the system. 
e The driver must at any time be prepared to take over complete control of the vehicle.” 


fully automated—the fourth (4) level of automation according to BASt [1]: “the system 
takes over lateral and longitudinal control completely within the individual specification 
of the application. 


e The driver does not need to monitor the system. 

e Before the specified limits of the application are reached, the system requests the driver 
to take over with a sufficient time buffer. 

e In the absence of a takeover, the system will return to the minimal risk condition by 
itself. 

e All system limits are detected by the system, the system is capable of returning to the 
minimum risk condition in all situations.” 


autonomous driving—for autonomous driving, the driving task [3] is performed in a way 
that is called fully automated (level 4 automation according to BASt [1]). This definition is 
extended by the assumption that the machine behavior stays within an initially set 
behavioral framework. 

machine driving capabilities—the machine (driving) capabilities are capabilities related 
to perception, cognition, behavior decisions as well as behavior execution. 
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driving robot—a driving robot is the implementation of the machine’s (driving) capa- 
bilities. The driving robot consists of hardware components (sensors, processors, and 
actuators) and software elements. It acts as the hardware and software, equivalent to the 
role of a driver in today’s vehicles as subject’ (the definition term for this system is still 
incomplete, so alternative suggestions are welcomed). 

fully autonomous vehicle—a fully autonomous vehicle is a vehicle which can drive 
almost all routes autonomously, on the same level as driver-only vehicles. This definition 
is beyond the BASt [1] definition as it defines the vehicle and not the degree of 
automation. 

exclusively autonomous vehicle (autonomous-only vehicle)—an exclusively autono- 
mous vehicle is a vehicle which can drive all routes for which the vehicle has been 
specified autonomously from start to destination. This definition is beyond the BASt [1] 
definition as it defines the vehicle and not the degree of automation. 

transportation task—the driving task describes a defined transportation object (vehicle, 
cargo, passenger etc.) that is transported from one start location to a destination location. 
Examples of the transportation task include park vehicle or get passenger to the requested 
destination. 

driving mission—the driving mission describes the journey from start to destination in 
execution of the transportation task. 

safe exit—the safe exit is a special driving mission. It leads the vehicle in the fastest way 
to a system status which allows the passengers to safely exit the vehicle. 

driver—a driver is the human operator of a vehicle, without further specifying the driving 
capability. This means within a range of humans who have a driver’s license. The driver is 
the subject of autonomy in case of non-fully automated driving. 

scenery—the term scenery according to Geyer et al. [8] refers to the static environment of 
the vehicle. This takes into consideration the geometry of pre-defined road types, number 
of lanes, curvature, position of traffic signs and traffic lights, as well as additional sta- 
tionary objects such as construction areas and natural (e.g. bushes and trees) or man-made 
objects (e.g. buildings, walls). 

dynamic elements—dynamic elements according to Geyer et al. [8] are temporary and 
spatially variable elements such as other road users, states of traffic lights, light as well as 
traffic conditions. 

scene—the scene according to Geyer et al. [8] is built by the scenery, dynamic elements 
and optional driving instructions. A scene starts with the end of the earlier scene or—in 
case of the first scene—with a defined starting scene. Within a scene the elements, their 
behavior as well as the position of the autonomously driving vehicle are defined. The 
dynamic elements change their states within a scene. 


‘A system which is capable of taking decisions depending on sensor data processed internally has 
additional degrees of freedom as compared to one with direct sensor data to actuator feedback or one 
without any capability of control actuation. The former one is termed a ‘subject’, the last one an 
‘object’... [7]. 
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situation—a clear definition of the term situation for the use-case description is still to be 
determined. In particular, an “objective, complete situation (description)” has to be dis- 
tinguished from a “subjective, projective situation (description)”. 

operating area—a spatial and/or temporal area, specified explicitly via the scenery and 
implicitly via the velocity, in which the vehicle can be moved autonomously through the 
operation of the driving robot. 

operating limit”—the operating limit is specified explicitly through the scenery and 
implicitly through the velocity, and is therefore a predictable boundary at which the 
driving task is handed over. 

functional limit’—a condition that appears in the permitted operation range but is not 
predictable in detail, which contradicts with continuing the autonomous journey. Even if 
the limit is not foreseeable, the driving robot recognizes it at an early stage. 
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Part | 
Man and Machine 


J. Christian Gerdes 


The very act of driving conjures a range of strong and very human emotions. Whether it is 
the feeling of freedom that the mobility of the car provides, the frustration of being stuck 
in traffic, the panic when realizing a potential collision looms or the joy of an open road 
with a favorite song on the radio, driving is a human experience. With automated vehicles, 
however, that experience changes—both for passengers in the automated car and other 
road users who must walk or drive alongside it as part of the social experience of traffic. 
The car ceases to be simply an extension of its human driver and becomes an agent in its 
own right, navigating through the highways and rules of human society. Given the 
sometimes uneasy relationship between humans and machines, what will these new 
interactions between humans and machines look like? 

Fabian Kroeger sets the stage for this discussion by showing what our cultural heritage 
reflects about our views of automation. In his chapter, Das automatisierte Fahren im 
gesellschaftsgeschichtlichen und kulturwissenschaftlichen Kontext, he details the long 
history of automated vehicle concepts and their treatment in media, beginning with 
Utopian visions of the benefits of such technology. His chapter traces the path from this 
early optimism towards the more cautionary themes found in recent film depictions of our 
automated future. This frames a central question running through the remaining chapters 
—how can the challenges of human-machine interaction be overcome to realize the 
promise of this technology? 

A key aspect of that interaction is how automated cars will conform to the ethical 
standards of the human world in which they operate. Patrick Lin opens this topic with an 
overall discussion of Why Ethics Matters for Autonomous Cars. Even with the best 
technology imaginable, sometimes crashes will be unavoidable for automated vehicles 
that share the road with human drivers and programmers must decide what to do when 
presented with such dilemma situations. As Lin shows, such decisions raise issues of 
equity, discrimination and unintended consequences that must be thoughtfully considered. 
Christian Gerdes and Sarah Thornton take the programming aspect of this discussion a 
step further with Implementable Ethics for Automated Vehicles. Mapping philosophical 
concepts to engineering concepts, they demonstrate how different approaches to ethical 
reasoning can be turned into algorithms that make decisions for automated vehicles. The 
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correct choice of an ethical framework for automated vehicles is far from obvious, 
however, and they argue that there are benefits to taking a more deontological, or 
rule-based, approach to dilemma situations and a more consequentialist, or outcome-based 
approach to operating in traffic. 

Interactions in traffic and societal acceptance depend not only upon the programming in 
the automated vehicles but how the automated vehicles are understood—or misunderstood 
—by the people around them. Ingo Wolf, in his chapter Wechselwirkung Mensch und 
autonomer Agent, discusses the psychological concept of a mental model and how such 
models can be critical in defining human interactions with automated systems. He outlines 
several possible mental models for interactions between humans and automated vehicles 
and, using the results of an online survey, shows which are closest to current perceptions 
of this technology. 

This part concludes with a look at the specific challenge presented by the informal 
communication channels that humans use to interpret the intentions to other road users or 
signal their own intentions. Berthold Faerber demonstrates the importance of nonverbal 
communication such as eye contact and gesture in his chapter Verhandlungen/ 
Kommunikation von autonomen Fahrzeugen; Kompensation von Fehlern anderer 
Verkehrsteilnehmer. This raises a range of questions such as how eye contact with 
someone in the driver seat of an automated vehicle who is not actually driving may be 
interpreted and what possibilities for new communication modalities might exist. 


Automated Driving in Its Social, Historical 
and Cultural Contexts 


Fabian Kroger 


3.1 Introduction 


The fascination with the promise of automotive autonomy has historically rested primarily 
on human drivers’ control of the gas pedal, steering wheel and brakes. Steering a car is the 
only area where the love of power and imagination still has free rein, observed the 
semiologist Roland Barthes in 1963 [3, p. 241]. The sociologist Henri Lefebvre also 
emphasized that the automobile was the last refuge of chance and risk in an increasingly 
controlled and managed society [23, p. 192]. 

Concealed in this risk, however, is not only freedom: there is also the threat of fatal 
accidents. In this sense, the car both runs with and against the grain of “the utopia of 
modernity,” as emphasized by cultural scientist Kate Meyer-Drawe [27, p. 111f]. 

The vision of man driving himself was therefore accompanied early on by the dream of 
self-steering cars bringing us safely to our desired destination. It is astonishing that the 
fulfillment of this wish has always remained 20 years away for almost the last 100 years 
[50, p. 14]. Between an automobile controlled by a driver and one that transports pas- 
sengers, there is evidently not only a technological break, but above all a cultural one. 
Driverless vehicles have played a prime role in our imaginings of technology, their history 
is largely a pictorial one. 

The following article traces some of the central elements in the almost 
hundred-year-long pictorial and technological history of driverless cars from a cultural 
science perspective (see also [22]). The central interest is the relationship of technological 
and pictorial designs from industrial research projects and the cultural imagination. We 
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will see how the logic of automatic automobiles unfolds as a fantastical object between the 
weird and the wonderful.’ 


3.2 Early Aviation and Radio Technology Lays the Foundation 


The story of the driverless car begins in the USA in the first half of the twentieth century. 
At this time, the sharp rise in fatal traffic accidents was becoming a social problem. Mass 
motorization had begun in the USA as early as the 1920s—three decades earlier than in 
Europe. More Americans were killed in auto accidents in the first four years after the First 
World War alone than in total in France up to that point [32, p. 25]. Overall, motorized 
road transport led to the accidental deaths of around 200,000 US citizens in the 1920s; by 
far the greatest number of these were pedestrians (ibid., p. 21). 

Driver error was seen as being the prime cause of accidents. That infrastructure and 
vehicle design are also critical factors in accidents’ form and severity was at first little 
acknowledged. The idea of substituting error-prone humans with technology thus prac- 
tically suggested itself. 

Two new technological developments from the fields of aviation and radio engineering 
belonged to the material conditions that an accident-free, self-driving automobile first 
made conceivable: 

Firstly, in Bezons near Paris, France in June 1914, Lawrence B. Sperry (1892-1923) 
introduced the first gyroscopic Airplane Stabilizer, which today is seen as the first 
autopilot. Before the eyes of astonished spectators, his mechanic climbed out onto the 
right wing during the flight, while in the cockpit Sperry stood up and raised his hands 
above his head. The system was based on the gyrocompass, which his father Elmer A. 
Sperry (1860-1930) had invented [6, p. 183]. It automatically equilibrated the aircraft, 
although it did not fully relieve the pilot of steering duties. John Hays Hammond (1888- 
1965) introduced a system for automatic course stabilization at around the same time. The 
inventions of Sperry and Hammond paved the way for the commercialization of autopilots 
[11, p. 1253 ff; 17, p. 1258 ff]. 

Secondly, radio technology was one of the technical requirements needed to be able to 
create a self-driving car. The new science of radio guidance was engaged with the remote 
control of moving mechanisms by means of radio waves [16, p. 171]. This technology 
was developed, amongst others, by the US military, which was experimenting with 
remote-controlled torpedos, ships and aircraft. 


'Note: The terms self-steering, automatic and autonomous vehicles are used here interchangeably. 
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Fig. 3.1 The first remote-controlled vehicle (USA 1921)—The Daily Ardmoreite, 12 August, 
1921, p. 5 [38]. Image rights: copyright by the Author 


3.3 Technical Beginnings: Driverless, but not Self-steering 


These pioneering works led to the first driverless car, which engineers of the Radio Air 
Service introduced to the public on the McCook air force test base in Dayton, Ohio on 5 
August, 1921. 

The 2.5 m-long car (Fig. 3.1) was controlled via radio from an army truck driving 
30 m behind. Technically speaking this, then, was not an autonomously self-driving 
vehicle, but rather a remote-controlled one—just that the driver was outside the car. What 
is noteworthy here is that the history of driverless cars is linked to the military, and was a 
media story right from the beginning—the press reported on it and published photos of the 
prototype [33]. 

In 1925 another remote controlled auto named American Wonder caused a sensation as 
it drove on Broadway in New York [37].” It was developed by the Houdina Radio Control 
Company. Military know-how also played a role here: Francis P. Houdina had worked as 


?Note: Due to a defective OCR scan of the TIME article, the name American Wonder was 
incorrectly recorded as Linnrican Wonder. This was carried over to numerous articles. 
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Fig. 3.2 Remote-controlled vehicle in a safety parade (USA, 1930s)—magic car to demonstrate 
safety, in: The Herald Statesman, 28 July, 1936, p. 1. Image rights: copyright by the Author 


an electrical engineer in the US Army. American Wonder was also steered by remote 
control from a second vehicle. 

In the 1930s, various offshoots of these remote-controlled automobiles appeared in 
public. At the one hand it was to be used as a commercial advertising vehicle, due to its 
notable qualities in terms of an attention economy. At the other hand it was taking a 
leading role in the so-called Safety Parades (Fig. 3.2) for road transport safety under the 
management of Captain J.J. Lynch. 

From 1931 to 1949, Lynch gave demonstrations of the remote-controlled vehicle in 37 
of the 48 US states. In 1934 he even demonstrated it in Australia. He manipulated the 
brakes, steering wheel and horn of the vehicle driving in front of him with the aid of a 
morse key. A spherical antenna received the code, although there are also reports of a wire 
between the vehicles. In Buffalo and at Utica Airport in 1933, the car was even controlled 
from an airplane. 

The driverless vehicle was almost perfectly suited to transport safety campaigns. On 
the occasion of a driving-safety campaign, Lynch stressed that modern automobiles’ 
safety depended on the driver. Because the driverless automobile obeyed all traffic rules, it 
would serve as an example for car drivers. 


3.4 Between the Weird and the Wonderful 


The press announced the remote-controlled automobile as the phantom auto [34], robot 
car [36] or magic car [35]. These metaphors show that the driverless car was perceived as 
a fantastical object from early on. To this day, it takes precisely that place between the 
weird and the wonderful that Tzvetan Todorov ascribes to fantasy literature [44]. 
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“We sped off with no-one holding the steering wheel, whizzed round corners, dodged 
other equally fine powered carriages, nobody honked their horn” [20, p. 7f]. In his early 
automation utopia Utopolis (1930), the German writer Werner Illing describes the wonder 
of “secretly self-steering autos” (ibid., p. 37). We are moving into a society where “the 
automatic machine” has replaced “work done by hand” (ibid., p. 19)—and also steering 
done by hand. “The most wonderfullest (sic) thing about it was that the car (...) behaved 
as if it had learnt all possible traffic rules by heart.” (ibid., p. 38). As in Lynch’s Safety 
Shows in the USA, the particular attraction of the driverless car here consists in keeping to 
social norms. 

The technical side of this literary utopia is also explained. Each car has a small prism 
eye at the front, which communicates with the traffic lights that are “embedded incon- 
spicuously in house walls.” “These mechanical eyes regulate speed and steering via 
alternating reflected images” (ibid.). There is even a navigation system that is reminiscent 
of today’s GPS devices: 


In place of the steering wheel I found a metal plate in which the map of the city was very 
finely and clearly etched. Above this a pin-sharp pointer. I had hardly begun to move this 
before the car started up and ran down streets I had never been down before. (ibid., p. 38). 


The description of wonderful self-steering automobiles is followed by the literary 
embellishment of its weird potential. In his short story The Living Machine (1935), the US 
science fiction author David H. Keller describes the invention of a self-driving car that can 
be navigated with spoken instructions [21]. At first, the benefits are spelled out. The 
“living machine” has contributed to a drop in the rate of accidents and opened up the car 
to new classes of users (ibid., p. 1467): 


Old people began to cross the continent in their own cars. Young people found the driverless 
car admirable for petting. The blind for the first time were safe. Parents found they could more 
safely send their children to school in the new car than in the old cars with a chauffeur. (ibid., 
p. 1470). 


The story turns when a mechanic notices that the cars have come to life. “Cars, without 
control, coursed the public highways, chasing pedestrians, killing little children, smashing 
fences.” (ibid., p. 1473). This imaginary phantasm of loss of control to driverless 
machines was to be the dominant template for the rest of the century. 


3.5 Only a Driverless Car is a Safe Car 


The driverless car received its first screen appearance in the American road safety edu- 
cation film The Safest Place (1935). Commissioned by General Motors (GM) and pro- 
duced by Jam Handy (1886-1983), this short film shows a car with no driver sticking to 
the traffic regulations in exemplary fashion. The vehicle always stays in its lane, never 
forgets to signal when turning, obeys all stop signs and never overtakes on dangerous 
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comers. Lynch had given similar reasons for campaigning for safety with driverless 
vehicles. 

The Safest Place does not portray a vision of the self-driving car as a technically 
achievable possibility, but rather as a moral model for further thought. Only drivers are 
held responsible for accidents in this film. They were shown as far more important for 
safety than technology—which is precisely why they should behave like automatons. 

The film’s blind spot is the machine: it is not seen as a risk factor. The fact that 
accidents also happen when the driver has made no mistake goes unmentioned. This is not 
surprising, as the car industry at that time was not yet convinced of the need for carrying 
out safety research [42, p. 161]. Visually, the film sums up this paradox of the infallible 
machine impressively. The camera films the car’s interior from the back seat and, as if by 
a ghost’s hand, the steering wheel turns. The front seats are empty. 

This approach is noteworthy, as the self-steering car appears to have disposed of all its 
occupants. Their bodies have been taken out of the car and out of the picture. They are 
now sitting outside the car in the movie theatre, in front of the screen. Only their gaze 
permits the audience to visually put itself back in the position of a traveler in the car. In 
ironic fashion, the film points here to the contradiction between safety and freedom: Is the 
car only safe when empty? 


3.6 Guide Wires Become Utopian Guiding Principles 


It is not only literary and filmic fantasies that surround the driverless car. At around the 
same time—the mid-1930s—the American oil and auto industries began working on 
ultramodern designs for the highways of the future together with urban planners, industrial 
designers, architects, transport researchers, and policy makers [50, p. 2]. At this time, 
automatic driving moved away from the early attempts at remote control, and was 
upgraded to a guiding principle of an automated transport system. The concept of the 
automated street was projected onto real landscapes, though immediate implementation 
was not planned. It was rather to act as a beacon in rebuilding trust in capitalism. 
Many US citizens had lost their faith in technological progress as a result of the Great 
Depression. The planning elite were thus drawn to propaganda boosters that were 
designed to return the luster to technological promises of salvation. 

Popular science magazines such as Popular Science and Popular Mechanics played an 
important role in this. They were heavily illustrated, which makes them valuable sources 
for studying pictorial history. In May 1938, Popular Science reported on the automatic 
transport of the future for the first time [31]. The author introduced the so-called 
guide-wire vision, which was to remain a cultural guiding principle up to the 1970s. All 
vehicles were to follow an electromagnetic wire sunk into the road surface whose impulse 
regulated speed and steering (ibid., p. 28). The justification for the design was the need to 
end the “slaughter” caused by human driving error and bad roads (ibid., p. 118). 


3 Automated Driving in Its Social, Historical and Cultural Contexts 47 


Astonishingly, this early guide-wire vision foresaw the switch from manual to automatic 
control (ibid., p. 27). 

Of particular interest here is the accompanying drawing by the illustrator Benjamin 
Goodwin Seielstad (1866-1960), which develops a utopian pictorial language that was to 
crop up in connection with automatic driving again and again over the decades (Fig. 3.3). 

Firstly, we look with a bird’s-eye view onto the freeway of the future, which leads 
arrow-straight to a vanishing point on the skyline. The shining white roadways merge as 
they head across the panorama’s horizon. The perspective emphatically signposts the path 
of progress to a better tomorrow. The strategically deployed vanishing point emphasizes 
the picture’s message. In the way it moves with the viewer, and thus unattainably leads to 
nowhere, it has an affinity with the utopian. 

Secondly, the exceedingly high viewpoint underscores the panorama’s meaning. The 
view onto the freeway appears to be the perspective from a hot-air balloon. The visual 
distance underlines that the vision is only in draft form, which we, along with Ernst Bloch, 
may name as a “landscape of desire” [5, p. 935]. 


Drowing by 
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Fig. 3.3 One of the first illustrations of an automatic freeway (detail)—Drawing B.G. Seielstad; 
Popular Science, May 1938, p. 28. Image rights: copyright by the Author 
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Popular Science explained the vision illustrated in the article by calling on Miller 
McClintock (1894-1960), Director of the Bureau for Street Traffic Research at Harvard 
University. McClintock was one of the most important masterminds of US transport 
planning [32]. In his doctoral thesis, he had analyzed the causes of traffic jams and 
accidents as early as 1925, and developed new traffic regulations and road construction 
works [26]. 

Significant impetus for automatic driving was provided by a large oil company. In the 
spring of 1937, Shell brought McClintock together with Bel Geddes, a pioneer of 
streamlining. For a Shell advertisement, they were to design a model of the City of 
Tomorrow [32, p. 249]. Bel Geddes [4] had already written about urbanism and car design 
in his book Horizons in 1932, but it was the Shell job that first had him developing the 
vision of automatic highways. In May 1938, he managed to convince GM to further 
develop the Shell model for the 1939 New York World’s Fair. 


3.7 Self-driving Transport in General Motors’ Futurama 


“Strange? Fantastic? Unbelievable? Remember, this is the world of 1960!” [13, p. 8]. At 
the World’s Fair, the utopia of driverless cars was given its first big stage. Building the 
World of Tomorrow proclaimed the fair’s motto, promising a technologically improved 
future while daily life was marked by economic depression and forebodings of imminent 
war. The most popular show at the World’s Fair was GM’s still-legendary Futurama, with 
its model of future transport systems. The term Futurama is derived from the Greek 
horama (En.: sight). In order to be able to see into the future, visitors to the fair had to 
enter the streamlined building designed by architect Albert Kahn (1869-1942) across 
curved ramps, whose esthetic was reminiscent of future superhighways as well as the 
above-mentioned utopian path of progress. 

Inside awaited 552 plush armchairs mounted on a conveyor. Visitors floated on it for 
16 min over a gigantic 3000 m” model landscape designed by Bel Geddes. The 
seven-million-dollar diorama encompassed half a million houses, a million trees and 
50,000 toy cars [25, p. 110; 30, p. 74]. Visitors were provided with a commentary over 
loudspeakers about what they could see beneath them: 10,000 animated model cars, 
dashing along a fourteen-lane highway, embodied the automatic traffic of tomorrow, kept 
in lane by radio waves. Only gas stations were missing, they would have reminded the 
visitor of the vision’s dependence on oil. The viewer also sought churches in vain, for the 
whole Futurama was already a place of worship, a tribute to a technological promise of 
transcendence. 

Similarly to Popular Science, Bel Geddes, who had worked in the theater until 1927, 
staked all on the primacy of the visual in this production: “One of the best ways to make a 
solution understandable to everybody is to make it visual, to dramatize it” (quoted in [50, 
p. 24]). The aim was to shape viewers’ desires and underscore industry’s claims to cultural 
hegemony over the future. For this, images were needed, not technical designs. 
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Futurama’s task was not to enlighten viewers, but to allow them into a realm of imagi- 
nation. How the public saw the future here was just as important as what it saw. They 
imitated “the aviator’s godlike gaze,” shared by modernist planners viewing the chaotic 
cities in the hope of controlling them [30, p. 77f]. At the same time, the ideas of Futurama 
came along in the era of superheroes (the first Superman comic appeared in 1938), whose 
earthly ascendency can be read as an allegory of rescue from the Depression. How the 
automatic highways were technically supposed to function remained, in contrast to the 
highly developed pictorial landscape, hazy. This imbalance is typical of all 
techno-utopias. GM would only disclose that vaguely described “experts” would direct car 
drivers when changing lanes from control towers [13, pp. 6, 8]. Clearly, the driver was 
supposed to stay at the controls, but simultaneously listen to a human instructor, who 
transmitted his orders via radio. Actually, according to James Wetmore, there are no 
indications that Bel Geddes’ highways were ever developed beyond the model [50, p. 5]. 

Nevertheless, Futurama had an enormous cultural impact which is still being felt today. 
Two years after the show, science fiction author Robert A. Heinlein was already inte- 
grating the automated highways made famous in Futurama into his novel Methusala’s 
Children (1941) [18, pp. 5, 27; 39, p. 27]. His book made plain the supervision of 
automated traffic from control centers. 

Beyond this, Heinlein presciently addressed a topic that would crop up in numerous 
films at the end of the twentieth century: With total road surveillance, a getaway is not 
possible in a car. The protagonists in Heinlein’s novel can only turn off the automatic 
lanes onto uncontrolled, normal roads by driving through a fence using manual control 
[18, p. 27f]. 


3.8 Estheticizing the Guide-Wire Principle 


“Why Don’t We Have... CRASH-PROOF HIGHWAYS”, asked the popular scientific 
magazine Mechanix Illustrated in 1953 [15, pp. 58ff, 184]. The Second World War had 
interrupted the dream of automatic driving. The automobile industry concentrated on 
military vehicle production in the 1940s. In the post-war period, the utopia of the 
driverless automobile sprang back to life. New technologies developed in the war were 
now to be used for civilian purposes. The guide-wire principle became more concrete in 
technical terms. Automatic driving was supposed to be achieved with magnet detectors as 
they had been used in the Second World War to detect landmines. Radar technology— 
also a military invention—was to regulate the distance to the car ahead. 

With its bird’s-eye panoramic view of a freeway, the illustration accompanying the 
article (Fig. 3.4) stunningly resembles the drawing from 1938 mentioned above. The 
viewpoint has now dropped down, however, as if the viewer has a sightline from a 
building right next to the road. The picture here suggests that automatic driving has moved 
closer. The vehicles are now also markedly more detailed, the bodywork drawn somewhat 
more futuristically than in the 1938 drawing. 


50 _ F. Kröger 


A ribbon of metallic material ap- 
proximately 12 inches wide is located 
= in the center 
and 
the highway concrete as it was 
pour 
‘The automatic pilot needs the fol- 
units, 


rights: copyright by the Author 


The picture shows automatic driving in a transitional phase between old and new 
mobility concepts. The driver has indeed let go of the steering wheel and turned to the rear 
passengers, but the front passenger has to strain her arm to be able to speak with her 
friends on the back seat. The illustrator was evidently not free to leave out the steering 
wheel altogether and turn the front seats around. Moreover, the picture highlights that the 
system can be manually overridden to exit the magnetic lane. The public was evidently 
not yet ready for a fully automatic vehicle. 


3.9 Setting the Family in Self-driving Vehicles 


Americas Independent Electric Light and Power Companies [1] placed an ad in LIFE 
magazine in 1956 (Fig. 3.5) which to this day gives one of the most detailed and 
estheticized depictions of autonomous driving. 

In the foreground we see a large sedan rolling along the middle lane of a ribbon of 
freeway stretching to the horizon. As well as the central perspective, the further-sunken 
viewpoint is very significant. While the viewer was given a high and distant perspective in 
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Fig. 3.5 Detailed version of the panorama—Magazine vol. 40, Nr. 5, 30. January 1956, p. 8. Image 
rights: copyright by the Author 


the above-mentioned illustrations, here we find ourselves close behind the car, which 
takes on a dramatically real appearance in this vision. 

The large glass roof is significant, taking up more than half of the picture. It directs our 
gaze into the car’s interior. A family of four is sitting around a table, as if the car were a 
substitute living room. All family members are portrayed conforming to contemporary 
social conventions. The father is in the driver’s seat, although he has abandoned the 
steering wheel. Mother and daughter are playing dominos, while the son is looking at his 
model airplane. Nobody appears to have his or her seatbelts fastened as the car follows a 
dashed line on the hardly-driven route. 

This motif shows that pictures of automatic vehicles were first and foremost an ideal 
stage for setting the harmonious nuclear family. The popular women’s magazine McCalls, 
for instance, defined the ideal family in 1954 through being together and sharing common 
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experiences [28, p. 180]. This “family togetherness” quickly evolved into a national ideal. 
The 1950s may be termed as a “golden age” for the family, especially visible in the young 
age of marriage and low divorce rate. This can be interpreted as a reaction to the times of 
war and the Depression, with families forming a counterbalance to the increasingly 
anonymized working environment under which personal relationships suffered (ibid., 
p. 177ff). The advertisement derives its attractractiveness from these socio-historical 
conditions, by demonstrating a utopian counterpoint to the world of work. In fact, one of 
the most important promises of autonomous driving to this day is that of transforming 
time spent driving into leisure time spent with the family. 


3.10 The Interstate System and the Dream of the Magic 
Highway 


A decade after the Second World War, the USA went through a time of dramatic changes 
with the end of the Korean War. The mass consumer society began to fully blossom. The 
expansion of automobilism, an indispensable part of the American lifestyle as far back as 
the 1920s, now led to an accelerated transformation of the landscape. 

Of prime significance was the construction of the supra-regional Interstate Highway 
System in 1956. Walt Disney’s film Magic Highway U.S.A. (1958) by Ward Kimball 
placed this gigantic freeway project in a linear history of progress. In a mix of docu- 
mentary archive recordings and fictional cartoon animations, the film tells the story of the 
American road [43, p. 112f; 48]. The negative consequences of mass motorization— 
breakdowns, accidents and jams—are set against the shining figure of the “highway 
engineer.” He will build roads to cure all ills. 

This also included automatic driving that was linked, as in the LIFE advertisement, to 
the conservative ideal image of the American family (Magic Highway U.S.A., from 39' 
00"). The crux of the matter here is a patriarchal society, full employment and con- 
sumption. An animated sequence shows a family getting into a futuristic car. After the 
father has entered the destination on a console, he holds a business conference call on a 
videophone and is afterwards dropped off at the office. Mother and son are driven to the 
mall. 

The promise of automatic driving addressed itself to long car journeys from the suburbs 
to the urban centers. Of the 13 million homes built in the USA from 1948 to 1958, 85 % 
were in suburbs [28, p. 183]. For families, this meant precisely the opposite of “family 
togetherness”. Due to having to commute to work, most fathers had hardly any time left 
over for attending to their families (ibid., p. 184). Their wives drove their children to 
school, music lessons and the doctor. They lacked social contact, their lives played out in 
isolation and boredom. In this respect, the film gives a distorted picture of the division of 
labor between the sexes, as it omits showing reproductive work. 

Magic Highway U.S.A. ends with an automatic vehicle on a centrally framed highway 
driving towards a glowing red sunset. We thus again come across the utopian esthetic 
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running through popular culture since the 1930s. Walt Disney summed up this attitude 
with words to the effect that roads connect all nations, “and help create a better under- 
standing among the peoples of the world” (Magic Highway U.S.A., 47'05"—47'25"). 
Automatic driving would lead, like a “magic carpet to new hopes, new dreams,” right up 
to a better life in future. It has seldom been clearer that future technologies are part of a 
promise of salvation. 


3.11 The Technical Realization of the Guide-Wire Vision and Its 
Illustration 


So far, we have seen how literature, film and print media portrayed the driverless car as 
being part of a utopian dream landscape from the 1930s onwards. In the 1950s, these 
literary and visual techno-fantasies acquired a new dynamic, as technologies were 
developed in the car industry that were supposed to make automatic driving possible. 

In 1953, GM started testing a miniature model of the automatic road together with the 
electronics manufacturer Radio Company of America (RCA) [50, p. 6]. Autonomous 
driving was then popularized in 1956 with the help of the Firebird II concept car as part of 
the travelling promotional show Motorama. The accompanying film Key to the Future by 
Michael Kidd, for instance, shows a family stuck in a traffic jam singing and dreaming of 
travelling in a Firebird II, which would get them there so much more comfortably. From a 
control tower, a uniformed man directs the car into an automatic express lane. The car 
then follows the guide wire and the father can push the control column (Yoke), as seen in 
aircraft, into the dashboard. At this time, though, the system did not technically function 
[50, p. 7]. 

On 14 February 1958, the first “automatically guided automobile” completed a test 
route of one mile at GM’s Technical Center in Warren (Michigan) [14]. The engineers had 
fitted the front area of a 1958 Chevrolet with two electronic sensors that followed a wire 
laid in the road and adjusted the steering wheel accordingly [24, p. 76]. In this project, 
GM drew on the research of the television pioneer Vladimir Zworykin (1888-1982). 

Popular science magazines picked up on these experiments with a multi-pronged 
pictorial strategy, whose rhetoric distanced itself clearly from the drawings of a techno- 
logical utopia. In 1958, for example, Popular Science reported on a test drive at the GM 
test track (ibid., pp. 75 ff, 227). The first photo shows a young girl laughing as she lets go 
of the wheel on an automatic car and puts her hands in the air like a “new human” 
(Fig. 3.6). 

By using this iconic motif, which references Sperry’s hands-free presentation of 
autopilots in June 1914, and to this day crops up again and again in the context of 
driverless cars, the photo clearly belongs to the class of the wonderful. The 
upward-pointing hands are reminiscent of the orans gesture, with which those at prayer 
plea for divine grace. 
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Fig. 3.6 Automatic driving on a GM test track in 1958—Popular Science, May 1958, p. 75. Image 
rights: copyright by the Author 


This pictorial relationship to the numinous is brought down to Earth with two pho- 
tographs associated with the profane. The first shows construction workers laying a guide 
wire in a road, the second the picture of a control computer. The photographs are there to 
verify self-driving cars’ actual existence, thus distancing themselves from the utopian 
pictorial esthetic. 

In the same year (1958), GM introduced the Firebird II prototype, which had no 
steering wheel. In the central console was a joystick (Unicontrol) that unified all driving 
functions—accelerating, braking, steering. The guide-wire vision was adopted unchanged. 


3.12 Cruise Control as a Byproduct of Technological Utopia 


In the mid-1950s, real practical applications were added to the utopian visions imagined in 
film, pictures and words, and the experimental technology systems portrayed in illustra- 
tions and photographs. 
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Popular Science reported in 1954 on an “Educated Gas Pedal,” the Speed-o-Stat, 
developed by Ralph Teetor (1890-1982). This automatic speed regulator and limiter soon 
came to enjoy great popularity under the names Tempomat or Cruise Control. The 
magazine presented the system as a milestone on the way to automatic driving, setting it 
among a larger movement of progress [40, pp. 166ff, 264; 50, p. 34]. But in fact, this 
movement was heading in another direction. With the development of the Tempomat, the 
car, driven automatically in more reduced and individualized form, detached itself from 
the grand vision of automatic highways. The Tempomat thus constituted a model for 
driver-assistance systems that automatic driving is now on the point of realizing. 

A Popular Science article from 1958 states that Chrysler has developed a new 
“supergadget,” an “autopilot” for the price of 86 dollars [41, pp. 105 ff, 248, 250]. There is 
no longer any talk of automatic transport, the utopian vision has shrunk and condensed 
into a product that is immediately available. 

This new logic of immediacy manifests itself in the accompanying photo (Fig. 3.7), 
which shows a chrome knob installed alongside the speedometer on the dashboard and 
serves to set the speed. Furthermore, we see a hand; thumb and forefinger are in the 
process of turning the dial. 
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Fig. 3.7 Autopilot dial, Chrysler 1958—Popular Science, April 1958, p. 105. Image rights: 
copyright by the Author 
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This close-up stands at the end of a long pictorial history that, starting from the initial 
distant landscape panoramas, has approached the technological object ever-more closely. 
This allows us to identify historically successive pictorial levels, running from the abstract 
to the concrete, from the drawing to the photograph, from exterior to interior, from 
complete overview to detail, from the collective to the individual. 


3.13 Weirdly Bringing the Machine to Life 


While press, film, and advertising images in the 1950s are still in awe of this vision, and 
give the limelight to images of dominant social desires, literature has the question of how 
strongly our cars of the future will resemble humans on its mind. It warns of future 
technology taking over and gives vent to unconscious fears. 

Isaac Asimov’s short story Sally (1953) was published in the same year as the Popular 
Science article discussed above. Asimov presents us with humanized “automatomobiles,” 
whose positronic motor assures that “there’d never been a human being behind her wheel” 
[2]. “You got in, punched your destination and let it go its own way” (ibid., p. 13). 
Autonomous driving was only difficult to implement in the beginning, then it abolished all 
accidents and “stopped the killing” (ibid.). 

The special quality of the story lies in Asimov’s portrayal of the increased anthro- 
pomorphism bound up in this vision. The “automatics” are vividly brought to life, they are 
described as “hard-working and affectionate” (ibid., p. 15). They “can talk to one another” 
(ibid., p. 34). Their emotions can be heard in the sound of the engine (ibid., p. 31). The 
convertibles in particular are “very vain” (ibid., p. 16). The automatomobile can also be 
switched to “manual” (ibid., p. 19), but one is not allowed to turn the motor off, as this 
causes the car pain (ibid., p. 20). 

This anthropomorphism then suddenly changes, as in Keller’s short story from 1935, 
into something strange and threatening. The cars develop their own will, they stop 
opening their doors (ibid., p. 18), roll up to opponents (ibid., p. 25) and finally begin to 
kill: “they found tire marks on his arms and body” (ibid., p. 32). We later find the same 
pattern again in John Carpenter’s film Christine (1981), which is based on a book of 
Stephen King. 


3.14 The Driverless Automobile in Film 


A shift can be seen in the sphere of self-driving cars’ pictorial history at the end of the 
1960s. Until that point, popular science magazines had carried the torch in catering for the 
public sensation with utopian pictorial concepts. But now cinema took over this role. This 
finally made the driverless car an important element of the entertainment industry, as 
James Wetmore confirms [50, p. 26]. 
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In intensity of pictorial language, the cinematic representations of autonomous driving 
extend far beyond the print media’s horizons. Their image worlds are not only indicators 
of societal hopes, but above all of certain fears. The pattern of weird and wonderful seen 
in literature is developed further. In doing so, film provides insights into a part of the 
collective imagination, into unconscious factors that contribute decisively to new tech- 
nology’s acceptance or refusal. Moreover, we see in them the transformation in the 
self-driving car’s public perception. The view of various human-machine interfaces is 
particularly interesting. 


3.15 From Friendly Helpers to Killer Machines 


The self-driving car makes its first appearance in film at the end of the 1960s: Robert 
Stevenson’s Herbie, The Love Bug (1968) wowed the public as a friendly, if willful, 
helper in Disney’s comedy. The small anthropomorphic racing Beetle has a life of his 
own. He moves by himself, falls in love with another car, wants to commit suicide out of 
jealousy, careens around drunkenly, shakes with rage, whimpers like a dog, runs a fever. 
As Herbie cannot speak, all of his feelings are illustrated by the comments of his 
mechanic, who appears to understand him. The self-driving car is shown as a 
brought-to-life, mechanical double of man, and serves as a metaphor for the strange, 
intense and intimate relationship between people and cars. 

Herbie falls into the category of the “purely fantastical,” as defined by Todorov [44], 
for the film never delivers a mechanical explanation for the car’s behavior. The driverless 
car is still completely attributable to the wonderful, as in Illings 1930 novel, and has 
nothing weird about it. 

This would soon fundamentally change. Two years before the energy crisis of 1973, a 
huge tanker truck hunted an unimposing salesman through the mountains of the Cali- 
fornian desert in Steven Spielberg’s first film, Duel. The truck sounds its horn infernally 
down the victim’s neck, the rumbling drone of its engine drowns out the radio. All 
attempts at escape fail. Although the truck is driven by a human, we never catch sight of 
the driver’s face. The machine, with its blank headlights for eyes, thus becomes an actual 
hunter. 

With Herbie and Duel, two archetypes of the driverless automobile were created which 
would go on to be embellished throughout the seventies. Herbie was given three sequels 
by 1980. Dudu (1971-1978), the German-Swiss B-movie series, depicts a vehicle with 
artificial intelligence in Ein Käfer auf Extratour (1973), which is said to be where the 
American producer Glen A. Larson found inspiration for the Knight Rider series, which 
we shall return to later. 

Parallel to this, horror films exploited the potential threat posed by driverless cars. The 
Car (1977) takes Spielberg’s Duel one stage further. A diabolical black sedan terrorizes 
the inhabitants of a small town. With darkened windows, close-together, piercing 
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headlights, chrome fenders in the form of a ram’s head, and the motor growling like a 
predator, the driverless car becomes a personification of evil. 

With Christine (1983), the self-driven car reached its horror-movie, anti-Herbie zenith. 
John Carpenter’s adaptation of Stephen King’s novel describes how the car come-to-life 
disposes of its driver. The radio that turns itself on, hints from the beginning that this 
Plymouth has a will of its own. The radio is not only a receiver, but mainly a subtle 
transmitter, it is the driverless car’s voice and soul. In contrast to The Car, however, 
Christine has an owner, the pubescent Arnie, who transforms himself through her, and is 
soon practically sexually obsessed by her. In the day, he drives, at night Christine goes 
hunting to kill. The windows are darkened like those in The Car. Christine is also 
invulnerable like a zombie, being able to heal herself after the worst accidents. The film’s 
particular appeal lies in the way it remains unclear until the end if it is actually Arnie 
driving Christine. 

These films show the automobile becoming autonomous, which was being reflected in 
reality. The negative consequences of mass motorization—a high number of vehicle 
deaths, ever-longer traffic jams and considerable smog pollution—became fully visible in 
the 1970s. The oil crisis of 1973 led, for instance, to stricter emissions rules, and the era of 
muscle cars was soon consigned to history. Both in Europe and the USA, this decade 
symbolized the end of the golden age of the automobile. 

Driverless cars were practically made for allegorical depictions of this trend in the 
cinema. 


3.16 The Rise of Microelectronics and the Fall 
of the Guide-Wire Concept 


While the weirdness of self-motion was being conjured up in the cinema, academic and 
industrial research began to distance itself from the concept of automatic highways. The 
gaps between technical and economic feasibility became too large, explains one of the 
engineers involved [50, p. 10]. In addition, the automobile industry had to adjust itself to 
stricter environmental regulations and safety standards. This required heavy investment. 

There was a trend towards research into autonomous vehicles that are not dependent on 
infrastructure such as guide wires. In the 1970s, Japan and the USA made great progress 
in attempting to provide cars with sight. 

In 1977 Sadayuki Tsugawa’s team from the Mechanical Engineering Laboratory in 
Tsukuba, Japan, presented the first visually guided autonomous vehicle that could record 
and process (on-board) pictures of lateral guide rails on the road via two cameras. The car 
was able to move with a speed of 10 km/h [46]. It had no function of lane marking 
detection. 

Hans Moravec from the Artificial Intelligence Lab at Stanford University in the USA 
researched robot navigation from 1973 to 1981, for which he employed the Stanford Cart, 
an experimental vehicle with four bicycle tires constructed as far back as 1960. Its original 
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purpose was to learn how to control a moon rover from Earth. In October 1979, with the 
help of the TV camera on-board (not the computers needed), the cart managed to move 
through a chair-filled room without human intervention. “The system was reliable for 
short runs, but slow. The cart moved 1 m every 10-15 min, in lurches. After rolling a 
meter it stopped, took some pictures, and thought about them for a long time. Then it 
planned a new path, executed a little of it, and paused again. It successfully drove the cart 
through several 20-m courses (each taking about 5 h) complex enough to necessitate three 
or four avoiding swerves; it failed in other trials in revealing ways” [29, p. 407]. 

At the same time, the rise of microelectronics led, moreover, to increasing use of 
electronics in vehicle technology (fuel injection, ignition), through to the launch of the 
first on-board computer (Check Control) in the 7-series BMW (E23). The era of active 
driver-assistance systems that directly intervene in the driving process began with the 
introduction of ABS in 1978. 

In the 1980s, the research on autonomous vehicles became a serious research topic for 
academic and industrial research in many countries. It would exceed the frame of this 
article to give a representative picture of all these efforts. Therefore we will concentrate on 
the most important pioneering works. Ernst Dickmanns from the University of the Federal 
Armed Forces in Munich (Germany) developed for the first time visually guided auto- 
nomous cars with digital processors onboard, based on the perception of multiple edge 
elements. In 1984, his team conceptualized the first vehicle that used dynamical models 
for visual autonomous guidance: The VaMoRs (Versuchsfahrzeug für autonome Mobilität 
und Rechnersehen) was a 5-ton van (Mercedes 508 D), that was able to carry the big sized 
computers and cameras of this time. In summer 1987, the VaMoRs drove autonomously 
—only with the help of cameras, without radar and GPS—20 km with a speed up to 
96 km/h (60 mph). The technology was based on a spatiotemporal dynamic model called 
4-D approach, which added to the three dimensions of space the category of time and 
integrated a feedback of prediction errors. It was only after this success, that the auto- 
motive industry (Daimler-Benz AG) became more seriously interested in the research of 
Dickmanns. 

The concept of vision-based autonomous driving gained momentum with the 
EUREKA-PROgraMme for a European Traffic of Highest Efficiency and Unprecedented 
Safety (PROMETHEUS) of the European Union (1987-1994). At first, the industry had a 
preference for lateral guidance of cars using electromagnetic fields generated by cables in 
the road, as known since the 1930s. But the team of Dickmanns successfully convinced 
the industry to privilege the concept of machine vision that would allow the detection of 
obstacles and avoid additional costs in infrastructure [7]. Today, this can be seen as a 
significant paradigm shift in the history of the driverless car. 

In the context of the PROMETHEUS-Project, the team of Dickmanns then developed 
with Mercedes Benz two S-Class (W 140) robotic vehicles: VaMP (UniBw Munich) and 
VITA-2 (DBAG) [8, 45, 47]. During the final event in October 1994 in France, the 
twin-robot vehicles drove more than 1000 km autonomously on three-lane highways 
around Paris, in the middle of heavy traffic and with speeds up to 130 km/h. The system 
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was based on real time evaluation of image sequences caught by four cameras. Steering, 
throttle and brakes were controlled automatically through computer commands. For “the 
first time, a machine vision system has been able to demonstrate its capability of deriving 
autonomously the decision for lane changing and passing” [9, p. 400]. This system was a 
major milestone for autonomous driving and a precursor of modern assistance systems 
such as Pre-Safe and Distronic Plus. 

In 1995, members of the NavLab of the Carnegie Mellon University in the USA 
presented a partially autonomous vehicle that drove from Pittsburgh to San Diego (“No 
Hands across America”). They also used a vision-based approach: Steering was based on 
camera images of the road. But a human driver had to control brakes and acceleration. In 
reaction, the UniBwM decided to demonstrate the capability of its VaMP in a fully 
autonomous long distance run from Neubiberg near Munich to Odense in Denmark. The 
car drove 95 % (1.678 km) of the trajectory autonomously, with speeds up to 180 km/h 
[10, p. 287]. The automated longitudinal and lateral control of the car was based only on 
video image processing from the front hemisphere. In the following years, other projects 
continued to develop the visual approach: In the context of the ARGO-project, which 
followed after Prometheus, the University of Parma in Italy used 1998 a Lancia Thema to 
drive 2000 km in Italy only camera based. 

The success of all these projects accelerated the shift from automatic lanes to auto- 
nomous vehicles. 


3.17 Knight Rider and On-board Electronics 


These technological developments also influenced cultural products. Cinema turned its 
back on the animistic demonization of driverless cars and began to take an interest in 
on-board electronics. 

A speaking car by the name of KITT (Knight Industries Two Thousand) assumed the 
lead role in the television series Knight Rider (1982-1986). The black Pontiac Firebird 
Trans Am with the red strip of lights in the radiator grill could both be manually controlled 
(normal mode) and drive automatically (auto mode). The driving robot supported the 
ex-policeman Michael Knight in chasing down criminals. 

KITT is thus Fully Automated with Extended Availability Through Driver (see Use 
Case Chap. 2). A part of its circuitry was developed at Stanford University, reported 
KITT, in an allusion to the development of the driverless Stanford Cart (Knight Rider, 
Season one, Episode Just my bill, 24:49). 

Knight Rider updates the anthropomorphic dimensions of the Herbie series into the 
information society. The series is centered around dialog and communication between 
humans and machines. Michael Knight calls up KITT on his wristwatch (ComLink).* 


3Knight Rider is said to have been inspired from a computer-aided vehicle in the series B.J. and the 
Bear (1979), Episode: Cains Cruiser [19, p. 1]. 
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These images not only dream of autonomous driving, but also of a car we can talk with, a 
car that answers. Michael always calls KITT “pal.” The machine is a partner to humans: 
Even in manual mode—with a gullwing steering wheel—it gives advice. Language 
functions smoothly as a human-machine interface here, in contrast to how it is portrayed 
as more problematic in films of the 1990s. 

Knight Rider also negotiates the axis of the weird and wonderful we are familiar with 
from history. In recourse to the stock of images from 1970s horror films, KITT duels with 
his automobile nemesis KARR, a vehicle programmed for self-preservation. 

But the potential to rebel against the driver also lurks in KITT, who does not normally 
act on its own accord. For one thing, it can overrule him in exceptional cases, for instance 
when his life is put in danger by his driving: “I cannot allow you to jeopardize your life. 
I am assuming control” (Knight Rider, Season one, Episode: Trust Doesn’t Rust, 41:53). 
We see here that the HAL 9000 computer struggling for autonomy in Stanley Kubrick’s 
film 2001: A Space Odyssey (1968) serves as the model for the conception of KITT 
[19, p. 2]. 

For another, the possibility of a third party reprogramming the vehicle is addressed, 
which is then a threat to its owner. These variations on the loss of control also appear in 
the current debates surrounding hacker attacks on autonomous vehicles. 


3.18 Autonomous Vehicles in Science Fiction Films 


In 1990, autonomous vehicles in science fiction films embarked on a boom that would last 
fifteen years. In ambivalent dystopias, cinema showed how man appropriates the beautiful 
new world of automatic driving, or how he is driven from it. 

In the conflict between humans and machines, the central question is: Who is in 
control? The possibility of manual override seen in Knight Rider is no longer present in 
some of these films. Getaway situations in particular became test cases for the degree of 
freedom of the automatic vehicle. Another matter addressed is how error-prone the 
human-machine interfaces are. It should be stressed that most films reflect research into 
autonomous driving here less than the development of active assistance systems. Three 
milestones are relevant at this point: Electronic Stability Program (ESP), which prevents a 
vehicle skidding, has been available since 1995; semi-automatic driving became possible 
with the introduction of Mercedes’ Distronic system in 1998; and the Dutch manufacturer 
TomTom put the first mobile navigation device on the market in 2004. This latter 
development was of crucial importance in popularizing machine-aided driving, as the 
driver then began to get used to obeying directions given by a computer. 
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3.19 The Getaway Car’s Demise in Fully Automated Vehicles 
with No Interface 


In science fiction films, we see self-driving cars developed in two different ways. First, 
there is a totalitarian version, exhibiting fully autonomous vehicles without any manual 
interface. 

Paul Verhoeven’s film Total Recall (1990) gives the first depiction of the getaway-car 
crisis in automatic autos of the future. With his pursuers approaching in a manually driven 
car, the worker Douglas Quaid, played by Arnold Schwarzenegger, tries to escape in an 
automatic taxi (Johnny Cab). The android does not understand the order to step on it at 
once, however, and instead asks for an address (Total Recall, 00:34:00). As a 
human-machine interface, language is more of a hindrance than a help, as the driving 
robot cannot simulate the complexity of human communication. Only after ripping out the 
mechanical chauffeur from his mounting and controlling the vehicle himself with a joy- 
stick does Quaid succeed in getting away. 

The surveillance utopia of Steven Spielberg’s Minority Report (2002) paints a con- 
siderably more dystopian picture. Here there is no way out, even by vandalizing the 
automatic vehicle to take manual control. The film shows self-driving vehicles as an 
element of a society of control where crimes can be prevented before they happen. When a 
police officer is himself charged with committing murder in the future, he tries to escape in 
an automatic maglev (magnetic levitation) vehicle. But a female voice soon rings out: 
“Security lockdown enabled: Revised destination: Office.” (Minority Report, 00:41:49). 
The car is automatically directed into the opposite lane and drives back to headquarters. 
The car has become fully automated (see Chap. 2), the authorities have special rights to 
take over the controls. The fugitive is as good as caught. The only option for him is to 
leave the car by jumping out of the window. 

This sequence shows one of the essential reservations regarding autonomous driving. 
One of the cultural attractions of the car historically lay in the suggestion of an identity 
with a self. Here, the vehicle slips not only the control of this self, it becomes a real trap 
because it can be remotely controlled from outside. It thus represents exactly the opposite 
of the anthropologically dominant, unconscious desire for escape that the automobile 
historically promised to fulfill. 


3.20 Selecting the Control Mode by Voice or the Touch 
of a Button 


A second group of films shows a “more democratic” version of automatic driving—the 
driver can choose between automatic and manual control via a human-machine interface. 

In Marco Brambilla’s futuristic thriller Demolition Man (1993), autonomous driving is 
part of a perfect world with no dangers, in which swear words, meat, chocolate, corporeal 
sex, petrol and spicy food have been outlawed. The film shows a futuristic police car that 
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can be controlled both manually and automatically. At the spoken command “self-drive 
on!” the car answers with a female voice and the steering wheel unfolds (Demolition Man 
12:42). 

As in Total Recall, language’s suitability as an interface is here deemed unreliable. The 
on-board computer signals a software error, and switching to self-drive mode is suddenly 
no longer possible. The car speeds into a bend and even screaming “brake!” cannot 
prevent the accident, as the vehicle has stopped responding (Demolition Man, 01:30:20). 
In this sequence, cinema reminds us how every new technology brings with it new types 
of accidents. 

Two further films stress that we can only escape if the autonomous vehicle can be 
switched to manual control. Luc Besson’s The Fifth Element (1997) tells the story of taxi 
driver Korben Dallas (Bruce Willis), who lives in a fully automated apartment and has a 
flying taxicab. As in many films, automation is here equated with total surveillance. 

At the same time, the film portrays physically pressing buttons as guaranteeing a last 
modicum of freedom. In order to evade a police check, Dallas deactivates his taxi’s 
automatic mode (The Fifth Element, 34:20). He does this by pressing a button, not by 
voice command. 

The whole setting of Alex Proyas’ film I, Robot (2004) is predicated on ambivalence 
towards the weirdness and wonder of modern machines. Commissioner Spooner (Will 
Smith) has a fully automated Audi RSQ that can also be manually controlled. The steering 
wheel, open on top with joysticks on the side, is extendable like that in the Firebird II. It is 
button-activated. 

Although the vehicle is driving through a tunnel at high speed, Spooner suddenly 
decides to take the controls himself (Fig. 9). “Manual driving,” confirms the car with a 
female voice (Z, Robot 21:23). His passenger, appalled, asks if he really wants to drive 
manually. Shortly afterwards they almost have an accident. At high speed, then, automatic 
control is safer than manual. What is meant by safety, however, depends on the context. In 
order to be able to reach safety in the face of attackers, the car must be driven manually (Z, 
Robot, 50:46). Again we can find the contradiction between autonomous driving and the 
getaway car. 

I, Robot is the most recent film to date depicting autonomous driving. This may be seen 
in the context of the US military’s robot races, which started in the same year. With the 
aim of having one third of American military vehicles drive autonomously in future, the 
Defense Advanced Research Projects Agency (DARPA) held the first Grand Challenge in 
2004, a desert race of autonomous vehicles. A VW Touareg named Stanley emerged as 
the winner of the second race in 2005. It had been developed at the Artificial Intelligence 
Laboratory at Stanford University under the supervision of Sebastian Thrun, who estab- 
lished the well-known fleet of autonomous vehicles at Google in 2008. 
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The driverless car had thus arrived in reality. For a long time, research inspired film; 
now it appears to be the other way around. Film serves as a reference for research teams: 
one of the participants in the 2007 Urban Challenge was a vehicle from the Team 
University of Central Florida that went by the name Knight Rider. 


3.21 Why Remote Control is Less Scary? 


We finish near where we started, with remote control, which is portrayed in film as the 
least problematic solution. Batman (1989) summons his vehicle via a radio device 
(Batman 01:08:55), James Bond controls his car in Tomorrow Never Dies (1997) via a 
touchpad on an early smartphone (Tomorrow Never Dies, 51:24, 57:26). 

Neither car is really driverless, the driver is merely outside the vehicle. The driver 
workspace is delocalized, but control is not fully handed over to the machine. For this 
reason, both cars are good as getaway vehicles. To be driven by a car is evidently 
incompatible with the status of a superhero. Physical contact with a material object to 
control—here the remote control—guarantees that the driver-subject’s bargaining power 
is preserved. 


3.22 Outlook 


This look into automatic driving’s pictorial and technological history has shown that 
innovations in technology and iconographic imagery have evolved in mutual interplay. 
Technological prototypes, literary metaphors and pictorial imaginings spark off each 
other, but never evolve in step. 

Remote control technology brought the first remote-controlled car onto the streets. The 
first truly autonomous vehicle emerged, however, in the literary imagination. From 1935— 
1955, the history of images is one step ahead of that of technology, and stimulates with its 
utopian highway panoramas. At the end of the 1960s, a strand of film history evolves that 
is relatively autonomous of technological development, but which then, from the 1980s 
onwards, directly comments on the increased use of electronics in driving. From 2005 on, 
autonomous driving appears to become cinematically unattractive as it approaches the 
threshold of the present. 

For the entire time, the cultural logic of the self-driving automobile develops in the 
space between the weird and the wonderful. 

We are concluding—to venture an overview—by returning to the opposition between 
driver-controlled and self-driving vehicles. The transition from a culture centered on 
driving ourselves around, to one of allowing ourselves to be driven, represents a huge 
challenge. How does Sheer Driving Pleasure (BMW) turn into the pleasure of Being 
Driven? 
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The automobile’s automation is not comparable with the automation of other objects 
from twentieth century industrial culture. One important effect of automation is relieving 
physically strenuous activities (escalators, elevators, washing machines). Even if these 
technical transformations required a shift in perception, the logic of the activity affected 
was not diametrically reversed. 

Steering a car, on the other hand, is not only a laborious, boring, tiring and dangerous 
activity. Driving is also fun. It is precisely its risk and danger that has been driving’s 
central appeal for drivers old and new. The transition to driverless automobiles therefore 
represents a cultural leap; it practically necessitates a reinvention of the car. It is worth 
remembering that, etymologically and historically, the term automobile combines the 
Greek autos (self) and the Latin mobilis (moveable). To be auto-mobile therefore means to 
be able to move oneself, to be self-mobile. Whether self here means that of the driver, or 
the car’s, thus essentially remains an open question. It may therefore be said with some 
justice that the auto only truly becomes automobile with the advent of autonomous 
driving. 


3.22.1 Is Siri Paving the Way for Iris? 


The success of future autonomous vehicles depends on a key element: the human-machine 
interface. Around the turn of the century, cinema assessed linguistic communication 
between man and machine with some skepticism. Acoustic exchanges were portrayed as 
more prone to breaking down and more open for ambiguities than haptic contact. 

Disposing of the steering wheel continues to be a taboo. It may be the case, however, 
that SIRI, the speech recognition software introduced into smartphones in 2011, is paving 
the way for linguistic interfaces in cars. A recently published study [49] made it clear that 
autonomous vehicles are met with greater trust if they are given a name, voice and gender. 
The car was given the name IRIS and a female voice that told the user how the vehicle 
worked. 

On the one hand, driverless cars break with all the historical rituals associated with 
control; on the other, they are practically predestined to render automobiles ever-more 
anthropomorphized. Today, we already treat our cars as living beings, and find nothing 
strange about it, to paraphrase Sigmund Freud’s remarks on children playing with dolls 
[12]. This bringing-to-life need not play out only in the weirdness of cinema, then, but 
may also be compatible with the wonderful. A tamed yet brought-to-life car could even 
reclaim something of the fairy tale [3] that the automobile lost in the course of mass 
motorization. 
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Filmography 


The Safest Place 
Magic Highway U.S.A. 
Key to the Future 

The Love Bug 

The Car 

Ein Käfer auf Extratour 
Duell 

Knight Rider 

Christine 

Batman 

Total Recall 
Demolition Man 
Tomorrow never dies 
Das fiinfte Element 
The 6th Day 

Minority Report 

I, Robot 


(1935) 
(1958) 
(1956) 
(1968) 
(1977) 
(1973) 
(1971) 
(1982-1986) 
(1983) 
(1989) 
(1990) 
(1993) 
(1997) 
(1997) 
(2000) 
(2002) 
(2004) 


Prod.: Jam Handy 

: Ward Kimball 

: Michael Kidd 

: Robert Stevenson 

: Elliot Silverstein 

: Rudolf Zehetgruber 
.: Steven Spielberg 
Prod.: Glen A. Larson 
: John Carpenter 

: Tim Burton 
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: Paul Verhoeven 

: Marco Brambilla 

: Roger Spottiswoode 
: Luc Besson 

: Roger Spottiswoode 
: Steven Spielberg 
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: Alex Proyas 
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Why Ethics Matters for Autonomous Cars 4 


Patrick Lin 


If motor vehicles are to be truly autonomous and able to operate responsibly on our roads, 
they will need to replicate—or do better than—the human decision-making process. But 
some decisions are more than just a mechanical application of traffic laws and plotting a 
safe path. They seem to require a sense of ethics, and this is a notoriously difficult 
capability to reduce into algorithms for a computer to follow. 

This chapter will explain why ethics matters for autonomous road vehicles, looking at 
the most urgent area of their programming. Nearly all of this work is still in front of the 
industry, which is to say that I will mainly raise the questions here and not presume to 
have any definitive answers at such an early stage of the technology. 

A brief note about terminology 

I will use “autonomous”, “self driving”, “driverless”, and “robot” interchangeably. 
These refer primarily to future vehicles that may have the ability to operate without human 
intervention for extended periods of time and to perform a broad range of actions. I will 
also use “cars” to refer loosely to all motor vehicles, from a motorcycle to a freight truck; 
those distinctions do not matter for the discussion here. 


4.1 Why Ethics Matters 


To start, let me offer a simple scenario that illustrates the need for ethics in autonomous 
cars. Imagine in some distant future, your autonomous car encounters this terrible choice: 
it must either swerve left and strike an eight-year old girl, or swerve right and strike an 
80-year old grandmother [33]. Given the car’s velocity, either victim would surely be 
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killed on impact. If you do not swerve, both victims will be struck and killed; so there is 
good reason to think that you ought to swerve one way or another. But what would be the 
ethically correct decision? If you were programming the self-driving car, how would you 
instruct it to behave if it ever encountered such a case, as rare as it may be? 

Striking the grandmother could be the lesser evil, at least to some eyes. The thinking is 
that the girl still has her entire life in front of her—a first love, a family of her own, a 
career, and other adventures and happiness—while the grandmother has already had a full 
life and her fair share of experiences. Further, the little girl is a moral innocent, more so 
than just about any adult. We might agree that the grandmother has a right to life and as 
valuable a life as the little girl’s; but nevertheless, there are reasons that seem to weigh in 
favor of saving the little girl over the grandmother, if an accident is unavoidable. Even the 
grandmother may insist on her own sacrifice, if she were given the chance to choose. 

But either choice is ethically incorrect, at least according to the relevant professional 
codes of ethics. Among its many pledges, the Institute of Electrical and Electronics 
Engineers (IEEE), for instance, commits itself and its 430,000+ members “to treat fairly 
all persons and to not engage in acts of discrimination based on race, religion, gender, 
disability, age, national origin, sexual orientation, gender identity, or gender expression” 
[23]. Therefore, to treat individuals differently on the basis of their age, when age is not a 
relevant factor, seems to be exactly the kind of discrimination the IEEE prohibits [18, 33]. 

Age does not appear to be a relevant factor in our scenario as it might be in, say, 
casting a young actor to play a child’s character in a movie. In that movie scenario, it 
would be appropriate to reject adult actors for the role. Anyway, a reason to discriminate 
does not necessarily justify that discrimination, since some reasons may be illegitimate. 
Even if we point to the disparity of life experiences between the old and the young, that 
difference isn’t automatically an appropriate basis for different treatment. 

Discriminating on the basis of age in our crash scenario would seem to be the same evil 
as discriminating on the basis of race, religion, gender, disability, national origin, and so 
on, even if we can invent reasons to prefer one such group over another. In Germany— 
home to many influential automotive companies that are working to develop self-driving 
technologies—the right to life and human dignity is basic and set forth in the first two 
articles of the very first chapter in the nation’s constitution [9]. So it is difficult to see how 
German law could even allow a company to create a product that is capable to making such 
a horrific and apparently illegal choice. The United States similarly strives to offer equal 
protection to all persons, such as stipulated in the fourteenth amendment of its constitution. 

If we cannot ethically choose a path forward, then what ought to be done? One solution 
is to refuse to make a swerve decision, allowing both victims to be struck; but this seems 
much worse than having only one victim die, even if we are prejudiced against her. 
Anyway, we can force a decision by modifying the scenario: assume that 10 or 100 other 
pedestrians would die, if the car continued forward; and swerving would again result in 
only a single death. 

Another solution could be to arbitrarily and unpredictably choose a path, without 
prejudice to either person [34]. But this too seems ethically troubling, in that we are 
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choosing between lives without any deliberation at all—to leave it to chance, when there 
are potentially some reasons to prefer one over the other, as distasteful and uncomfortable 
as those reasons may be. This is a dilemma that is not easily solvable and therefore points 
to a need for ethics in developing autonomous cars. 


4.1.1 Beyond Crash-Avoidance 


Many readers may object right away that the dilemma above, as well as others that follow, 
will never occur with autonomous cars. It may be suggested that future cars need not 
confront hard ethical choices, that simply stopping the car or handing control back to the 
human operator is the easy path around ethics. But I will contend here that braking and 
relinquishing control will not always be enough. Those solutions may be the best we have 
today, but if automated cars are to ever operate more broadly outside of limited highway 
environments, they will need more response-options. 

Current research already makes this case as a matter of physics [12, 13], but we can 
also make a case from commonsense. Many ordinary scenarios exist today in which 
braking is not the best or safest move, whether by human or self-driving car. A wet road or 
a tailgater, for instance, may make it dangerous to slam the brakes, as opposed to some 
other action such as steering around the obstacle or simply through it, if it is a small 
object. Today, the most advanced self-driving cars cannot detect small objects such as 
squirrels [7]; therefore, they presumably cannot also detect squirrel-sized rocks, potholes, 
kittens, and other small but consequential hazards can cause equipment failure, such as tire 
blowouts or sensor errors, or deviations from a safe path. 

In these and many other cases, there may not be enough time to hand control back to the 
driver. Some simulation experiments suggest that human drivers need up to 40 s to 
regain situation awareness, depending on the distracting activity, e.g., reading or napping— 
far longer than the 1-2 s of reaction time required for typical accident scenarios [18, 38]. 
This means that the car must be responsible for making decisions when it is unreasonable to 
expect a timely transfer of control back to the human, and again braking might not be the 
most responsible action. 

One possible reply is that, while imperfect, braking could successfully avoid the 
majority of emergency situations a robot car may find itself it, even if it regrettably makes 
things worse in a small number of cases. The benefits far outweigh the risks, presumably, 
and the numbers speak for themselves. Or do they? I will discuss the dangers of morality 
by math throughout this chapter. 

Braking and other responses in the service of crash-avoidance won’t be enough, 
because crash-avoidance is not enough. Some accidents are unavoidable—such as when 
an animal or pedestrian darts out in front of your moving car—and therefore autonomous 
cars will need to engage in crash-optimization as well. Optimizing crashes means to 
choose the course of action that will likely lead to the least amount of harm, and this could 


72 P. Lin 


mean a forced choice between two evils, for instance, choosing to strike either the 
eight-year old girl or the 80-year old grandmother in my first scenario above. 


4.1.2 Crash-Optimization Means Targeting 


There may be reasons, by the way, to prefer choosing to run over the eight-year old girl 
that I have not yet mentioned. If the autonomous car were most interested in protecting its 
own occupants, then it would make sense to choose a collision with the lightest object 
possible (the girl). If the choice were between two vehicles, then the car should be 
programmed to prefer striking a lighter vehicle (such as a Mini Cooper or motorcycle) 
than a heavier one (such as a sports utility vehicle (SUV) or truck) in an adjacent lane 
[18, 34]. 

On the other hand, if the car were charged with protecting other drivers and pedestrians 
over its own occupants—not an unreasonable imperative—then it should be programmed 
to prefer a collision with the heavier vehicle than the lighter one. If vehicle-to-vehicle 
(V2V) and vehicle-to-infrastructure (V2I) communications are rolled out (or V2X to refer 
to both), or if an autonomous car can identify the specific models of other cars on the road, 
then it seems to make sense to collide with a safer vehicle (such as a Volvo SUV that has a 
reputation for safety) over a car not known for crash-safety (such as a Ford Pinto that’s 
prone to exploding upon impact). 

This strategy may be both legally and ethically better than the previous one of jealously 
protecting the car’s own occupants. It could minimize lawsuits, because any injury to 
others would be less severe. Also, because the driver is the one who introduced the risk to 
society—operating an autonomous vehicle on public roads—the driver may be legally 
obligated, or at least morally obligated, to absorb the brunt of any harm, at least when 
squared off against pedestrians, bicycles, and perhaps lighter vehicles. 

The ethical point here, however, is that no matter which strategy is adopted by an 
original equipment manufacturer (OEM), i.e., auto manufacturer, programming a car to 
choose a collision with any particular kind of object over another very much resembles a 
targeting algorithm [33]. Somewhat related to the military sense of selecting targets, 
crash-optimization algorithms may involve the deliberate and systematic discrimination 
of, say, large vehicles or Volvos to collide into. The owners or operators of these targeted 
vehicles bear this burden through no fault of their own, other than perhaps that they care 
about safety or need an SUV to transport a large family. 


4.1.3 Beyond Harm 


The problem is starkly highlighted by the following scenario [15-17, 34]: Again, imagine 
that an autonomous car is facing an imminent crash, but it could select one of two targets 
in adjacent lanes to swerve into: either a motorcyclist who is wearing a helmet, or a 
motorcyclist who is not. It probably doesn’t matter much to the safety of the car itself or 


4 Why Ethics Matters for Autonomous Cars 73 


its occupants whether the motorcyclist is wearing a helmet; the impact of a helmet into a 
car window doesn’t introduce that much more risk that the autonomous car should want to 
avoid it over anything else. But it matters a lot to the motorcyclist whether s/he is wearing 
a helmet: the one without a helmet would probably not survive such a collision. Therefore, 
in this dreadful scenario, it seems reasonable to program a good autonomous car to swerve 
into the motorcyclist with the helmet. 

But how well is justice and public policy served by this crash-optimization design? 
Motorcyclists who wear helmets are essentially being penalized and discriminated against 
for their responsible decision to wear a helmet. This may encourage some motorcyclists to 
not wear helmets, in order to avoid targeting by autonomous cars. Likewise, in the 
previous scenario, sales may decline for automotive brands known for safety, such as 
Volvo and Mercedes Benz, insofar as customers want to avoid being the preferred targets 
of crash-optimization systems. 

Some readers may want to argue that the motorcyclist without a helmet ought to be 
targeted, for instance, because he has acted recklessly and therefore is more deserving of 
harm. Even if that’s the correct design, notice that we are again moving beyond harm in 
making crash-optimization decisions. We’re still talking about justice and other such 
ethical considerations, and that’s the point: it’s not just a numbers game. 

Programmers in such scenarios, as rare as they may be, would need to design 
cost-functions—algorithms that assign and calculate the expected costs of various possible 
options, selecting the one with the lowest costs—that potentially determine who gets to 
live and who gets to die. And this is fundamentally an ethics problem, one that demands 
much more care and transparency in reasoning than seems currently offered. Indeed, it is 
difficult to imagine a weightier and more profoundly serious decision a programmer 
would ever have to make. Yet, there is little discussion about this core issue to date. 


4.2 Scenarios that Implicate Ethics 


In addition to the ones posited above, there are many actual and hypothetical scenarios 
that involve judgments about ethics. I will describe some here to show how ordinary 
assumptions in ethics can be challenged. 


4.2.1 The Deer 


Though difficult to quantify due to inconsistent and under-reporting, experts estimate that 
more than a million car accidents per year in the US are caused by deer [6, 48]. Many, if 
not most, drivers have been startled by an unexpected animal on the road, a dangerous 
situation for both parties. Deconstructing a typical accident, or near-accident, involving an 
animal illustrates the complexity of the decisions facing the driver [30]. While all this 
happens within seconds—not enough time for careful deliberations by human drivers—an 
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autonomous car could have the virtue of a (presumably) thoughtful decision-making script 
to very quickly react in an optimal way. If it is able to account for the many variables, then 
it ought to, for the most informed decision possible. 

First, suppose an object appears on the road directly in front of a car in autonomous 
mode. Is there time to reasonably hand control back to the human behind the wheel? 
(Probably not.) If not, is there time to stop the car? Would the car need to brake hard, or 
would moderate braking be sufficient? The decision to brake depends, again, on road 
conditions and whether a tailgater (such as a big-rig truck) is behind you, including its 
speed to determine the severity of a possible rear-end collision. 

Second, what is the object? Is it an animal, a person, or something else? If it is an 
animal, are some animals permissible to run over? It may be safer to continue ahead and 
strike a squirrel, for instance, than to violently swerve around it and risk losing control of 
the car. However, larger animals, such as deer and cows, are more likely to cause serious 
damage to the car and injuries to occupants than a spun-out car. Other animals, still, have 
special places in our hearts and should be avoided if possible, such as pet dogs and cats. 

Third, if the car should get out of the way—either in conjunction with braking or not— 
should it swerve to the left or to the right? In the US and other nations in which drivers 
must stay on the right side of the road, turning to the right may mean driving off the road, 
potentially into a ditch or a tree. Not only could harm to the car and occupants be likely, 
but it also matters how many occupants are in the car. The decision to drive into an 
embankment seems different when only one adult driver is in the car, than when several 
children are inside too. 

On the other hand, turning to the left may mean driving into an opposite lane, potentially 
into a head-on collision with incoming vehicles. If such a collision is unavoidable, then it 
matters what kind of vehicle we would crash into (e.g., is it a compact car or SUV?), how 
heavy incoming traffic is (e.g., would more than one vehicle be involved?), how many 
persons may be involved (e.g., are there children in the other car?). Of course, here we are 
assuming perfect sensing and V2X communications that can help answer these questions. 
If we cannot answer the questions, then we face a possibly large unknown risk, which 
makes driving into incoming traffic perhaps the worst option available. 

Other factors relevant to the decision-points above include: the road-shoulder type 
(paved, gravel, none, etc.), the condition of the car’s tires and brakes, whether the car’s 
occupants are seat-belted, whether the car is transporting dangerous cargo that could spill 
or explode, proximity to hospital or emergency rescue, damage to property such as houses 
and buildings, and more. These variables influence the probability of an accident as well 
as expected harm, both of which are needed in selecting the best course of action. 

From this short analysis of a typical crash (or possible crash) with an animal, we can 
already see a daunting number of factors to account for. Sensing technologies today 
cannot answer some or many of the questions above, but it is already unclear that braking 
should be the safest default option—as a proxy for the most ethical option—given these 
uncertain conditions, all things considered. Automated cars today can already detect 
whether there is oncoming traffic in the opposite lane. Therefore, it is at least possible that 
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they can be programmed to maneuver slightly into the incoming lane under some con- 
ditions, e.g., when there are no incoming cars and when it may be dangerous to slam on 
the brakes. 

Whether or not sensing technologies will improve enough to deliver answers to our 
questions above, a programmer or OEM would still need to assign costs or weights to 
various actions and objects as best as they can. Yet these values are not intrinsic to or 
discoverable by science or engineering. Values are something that we humans must 
stipulate and ideally agree upon. In constructing algorithms to control an autonomous car, 
ethics is already implied in the design process. Any decision that involves a tradeoff such 
as to strike object x instead of object y requires a value-judgment about the wisdom of the 
tradeoff, that is, the relative weights of x and y. And the design process can be made better 
by recognizing the ethical implications and by engaging the broader community to ensure 
that those values are represented correctly or at least transparently. Working in a moral 
bubble is less likely to deliver results that are acceptable to society. 

Again, in a real-world accident today, a human driver usually has neither the time nor 
the information needed to make the most ethical or least harmful decisions. A person who 
is startled by a small animal on an otherwise-uneventful drive may very well react poorly. 
He might drive into oncoming traffic and kill a family, or oversteer into a ditch and to his 
own death. Neither of these results, however, is likely to lead to criminal prosecution by 
themselves, since there was no forethought, malice, negligence, or bad intent in making a 
forced, split-second reaction. But the programmer and OEM do not operate under the 
sanctuary of reasonable instincts; they make potentially life-and-death decisions under no 
truly urgent time-constraint and therefore incur the responsibility of making better 
decisions than human drivers reacting reflexively in surprise situations. 


4.2.2 Self-sacrifice 


As we can see, real-world accidents can be very complicated. In philosophy and ethics, a 
familiar method is to simplify the issues through hypothetical scenarios, otherwise known 
as “thought-experiments.” This is similar to everyday science experiments in which 
researchers create unusual conditions to isolate and test desired variables, such as sending 
spiders into outer space to see how micro-gravity affects their ability to spin webs. It is not 
a good objection to those experiments to say that no spiders exist naturally in space; that 
misses the point of the experiment. 

Likewise, it is no objection to our hypothetical examples that they are outlandish and 
unlikely to happen in the real world, such as a car that can distinguish an eight-year old 
from an 80-year old (though with improving biometrics, facial recognition technologies, 
and linked databases, this doesn’t seem impossible). Our thought-experiments are still 
useful in drawing out certain ethical intuitions and principles we want to test. 

With that understanding, we can devise hypothetical scenarios to see that reasonable 
ethical principles can lead to controversial results in the context of autonomous driving. 
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Digging into a standard philosophical toolbox for help with ethical dilemmas, one of the 
first principles we might reach for is consequentialism: that the right thing to do is 
whatever leads to the best results, especially in quantified terms [44]. As it applies here, 
consequentialism suggests that we should strive to minimize harm and maximize whatever 
it is that matters, such as, the number of happy lives. 

In this thought-experiment, your future autonomous car is driving you on a narrow 
road, alongside a cliff. No one and no technology could foresee that a school bus with 28 
children would appear around the corner, partially in your lane [29, 36]. Your car cal- 
culates that crash is imminent; given the velocities and distance, there is no possible action 
that can avoid harming you. What should your robot car do? 

A good, standard-issue consequentialist would want to optimize results, that is, max- 
imize the number of happy lives and minimize harm. Assuming that all lives in this 
scenario are more or less equally happy—for instance, there’s no super-happy or 
super-depressed person, and no very important person who has unusual influence over the 
welfare of others—they would each count for about the same in our moral calculation. As 
you like, we may either ignore or account for the issue of whether there is extra value in 
the life of innocent child who has more years of happiness ahead of her than an average 
adult; that doesn’t matter much for this scenario. 

The robot car’s two main choices seem to be: (1) to slam on the brakes and crash into 
the bus, risking everyone’s lives, or (2) to drive off the cliff, sparing the lives of everyone 
on the bus. Performing a quick expected-utility calculation, if the odds of death to each 
person (including the adult bus driver) in the accident averaged more than one in 30, then 
colliding into the bus would yield the expected result of more than one death, up to all 30 
persons. (Let’s say the actual odds are one in three, which gives an expected result of 10 
deaths.) If driving off a cliff meant certain death, or the odds of one in one, then the 
expected result of that would be exactly one death (your own) and no more. The right 
consequentialist decision for the robot car—if all we care about is maximizing lives and 
minimizing deaths—is apparently to drive off the cliff and sacrifice the driver, since it is 
better that only one person should die rather than more than one, especially 10 or all 30 
persons. 

This decision would likely be different if, instead of a school bus, your robot car were 
about to collide with another passenger car carrying five persons. Given the same average 
odds of death, one in 10, the expected number of deaths in a collision would only be 0.6, 
while the expected number of deaths in driving off a cliff remains at one. In that case, the right 
consequentialist decision would be to allow the accident to occur, as long as the average odds 
of death are less than one in six. If, instead of another vehicle, your car were about to collide 
with a deer, then the decision to stay on the road, despite an ensuing accident, would be even 
more obvious insofar as we value a deer’s life less than a human life. 

Back to the school-bus scenario, programming an autonomous car with a conse- 
quentialist framework for ethics would seem to imply your sacrifice. But what is most 
striking about this case might not even be your death or the moral mathematics: if you 
were in a manually driven car today, driving off the cliff might still be the most ethical 
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choice you could make, so perhaps you would choose certain death anyway, had you the 
time to consider the options. However, it is one thing for you to willingly make that 
decision of sacrifice yourself, and quite another matter for a machine to make that decision 
without your consent or foreknowledge that self-sacrifice was even a possibility. That is, 
there is an astonishing lack of transparency and therefore consent in such a grave decision, 
one of the most important that can be made about one’s life—perhaps noble if voluntary, 
but criminal if not. 

Thus, reasonable ethical principles—e.g., aiming to save the greatest number of lives— 
can be stressed in the context of autonomous driving. An operator of an autonomous 
vehicle, rightly or not, may very well value his own life over that of everyone else’s, even 
that of 29 others; or he may even explicitly reject consequentialism. Even if conse- 
quentialism is the best ethical theory and the car’s moral calculations are correct, the 
problem may not be with the ethics but with a lack of discussion about ethics. Industry, 
therefore, may do well to have such a discussion and set expectations with the public. 
Users—and news headlines—may likely be more forgiving if it is explained in advance 
that self-sacrifice may be a justified feature, not a bug. 


4.2.3 Ducking Harm 


Other ethical principles can create dilemmas, too. It is generally uncontroversial that, if 
you can easily avoid harm to yourself, then you should do it. Indeed, it may be morally 
required that you save yourself when possible, if your life is intrinsically valuable or worth 
protecting; and it is at least extrinsically valuable if you had a dependent family. Auto 
manufacturers or OEMs seem to take this principle for granted as well: if an autonomous 
car can easily avoid a crash, e.g., by braking or swerving, then it should. No ethical 
problem here—or is there? 

In another thought-experiment [15, 18, 33], your robotic car is stopped at an inter- 
section and waits patiently for the children who are crossing in front of you. Your car 
detects a pickup truck coming up behind you, about to cause a rear-end collision with you. 
The crash would likely damage your car to some degree and perhaps cause minor injury to 
you, such as whiplash, but certainly not death. To avoid this harm, your car is pro- 
grammed to dash out of the way, if it can do so safely. In this case, your car can easily turn 
right at the intersection and avoid the rear-end collision. It follows this programming, but 
in doing so, it clears a path for the truck to continue through the intersection, killing a 
couple children and seriously injuring others. 

Was this the correct way to program an autonomous car? In most cases of an 
impending rear-end collision, probably yes. But in this particular case, the design decision 
meant saving you from minor injury at the expense of serious injury and death of several 
children, and this hardly seems to be the right choice. In an important respect, you (or the 
car) are responsible for their deaths: you (or the car) killed the children by removing an 
obstruction that prevented harm from falling upon them, just as you would be responsible 
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for a person’s death if you removed a shield he was holding in front of a stream of gunfire. 
And killing innocent people has legal and moral ramifications. 

As with the self-sacrifice scenario above, it might be that in the same situation today, in 
a human-driven car, you would make the same decision to save yourself from injury, if 
you were to see a fast-approaching vehicle about to slam into you. That is, the result might 
not change if a human made the on-the-spot decision. But, again, it is one thing to make 
such a judgment in the panic of the moment, but another less forgivable thing for a 
programmer—far removed from the scene and a year or more in advance—to create a 
cost-function that resulted in these deaths. Either the programmer did so deliberately, or 
she did it unintentionally, unaware that this was a possibility. If the former, then this could 
be construed as premeditated homicide; and if the latter, gross negligence. 

Either way is very bad for the programmer and perhaps an inherent risk in the business, 
when one attempts to replicate human decision-making in a broad range of dynamic 
scenarios. Sometimes, an autonomous car may be faced with a “no-win” scenario, putting 
the programmer in a difficult but all too real position. To mitigate this risk, industry may 
do well to set expectations not only with users but also with broader society, educating 
them that they could also become victims even if not operating or in a robot car, and that 
perhaps this is justified by a greater public or overall good. 


4.2.4 Trolley Problems 


One of the most iconic thought-experiments in ethics is the trolley problem [4, 8, 11, 47], 
and this is one that may now occur in the real world, if autonomous vehicles come to be. 
Indeed, driverless trains are already operating in dozens of cities worldwide and could 
bring this scene to life [24]. The classical dilemma involves a runaway trolley (or train) 
that is about to run over and kill five unaware people standing on the tracks. Looking at 
the scene from the outside, you find yourself standing next to a switch: if you pull the 
switch, you can shunt the train to a right-hand set of tracks, thereby saving the five 
individuals on the track. Unfortunately, there is one person standing on the right-hand set 
of tracks who would then be killed. What is the right decision? 

The “correct” decision continues to be a subject of much debate in philosophy. Both 
answers seem reasonable and defensible. A consequentialist might justify switching the 
tracks to save five people, even at the regrettable expense of one. But a non-consequentialist, 
someone who considers more than just the math or results, might object on the grounds that 
switching tracks constitutes an act of killing (the one person), while doing nothing is merely 
allowing someone to die (the five individuals); and that it is morally and legally worse to kill 
than to let die. 

Killing implies that you are directly responsible for a person’s death: had you not done 
what you did, the person would have lived. Letting die, however, involves much less 
responsibility on your part, if any, since some causal process was already underway that 
was not initiated or otherwise controlled by you. The question of whether it is worse to kill 
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than to let die is also subject to debate in philosophy. But let us bracket that for the 
moment, as a final answer is not necessary for our discussion, only that it is reasonable to 
believe that proposition. 

Adapting the trolley problem to the technology at hand, let us suppose that you are 
driving an autonomous car in manual mode; you are in control. Either intentionally or not 
—you could be homicidal or simply inattentive—you are about to run over and kill five 
pedestrians. Your car’s crash-avoidance system detects the possible accident and 
activates, forcibly taking control of the car from your hands. To avoid this disaster, it 
swerves in the only direction it can, let’s say to the right. But on the right is a single 
pedestrian who is unfortunately killed. 

Was this the right decision for your car to make? Again, a consequentialist would say 
yes: it is better that only one person dies than five. But a non-consequentialist might 
appeal to a moral distinction between killing and letting die, and this matters to OEMs for 
liability reasons. If the car does not wrestle control from the human driver, then it (and the 
OEM) would perhaps not be responsible for the deaths of the five pedestrians while you 
were driving the car; it is merely letting those victims die. But if the car does take control 
and make a decision that results in the death of a person, then it (and the OEM) becomes 
responsible for killing a person. 

As with the trolley problem, either choice seems defensible. Results do matter, so it is 
not ridiculous to think that the car should be programmed to act and save lives, even at the 
expense of a fewer number of lives. Yet it also seems reasonable to think that killing is 
worse than letting die, especially in the eyes of the law. What I want to highlight here is 
not so much the answer but the process of deliberation that points us toward one answer 
over another. To the extent that there could be many acceptable answers to any given 
ethical dilemma, how well one answer can be defended is crucial toward supporting that 
answer over others. 

Industry again would do well to set expectations by debating and explaining in advance 
its reasoning behind key algorithms that could result in life or death. Transparency, or 
showing one’s math, is an important part of doing ethics, not just the answer itself. 


4.3 Next Steps 


Notice that the ethical issues discussed in this paper do not depend on technology errors, 
poor maintenance, improper servicing, security vulnerabilities, or other failings—and all 
those will occur too. No complex technology we have created has been infallible. Even 
industries with money directly at stake have not solved this problem. For instance, bank 
ATMs continue to make headlines when they hemorrhage cash—tens of thousands of 
dollars more than the account holder actually has—because of software glitches alone 
[2, 10], never mind hacking. And just about every computing device we have created has 
been hacked or is hackable, including neural implants and military systems [3, 28]. 
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These vulnerabilities and errors certainly can cause harm in the context of autonomous 
cars, and it would be unethically irresponsible to safeguard against them where we can. 
Putting these technology issues aside and even assuming that perfect technology is 
available, there are still many other safety and ethical questions to worry about, such as 
the programming issues above. 


4.3.1 Broader Ethical Issues 


But programming is only one of many areas to reflect upon as society begins to adopt 
autonomous driving technologies. Assigning legal and moral responsibility for crashes is a 
popular topic already [1, 14, 20, 22, 49, 51]. Here are a few others, as part of a much 
longer list of possible questions: 

Does it matter to ethics if a car is publicly owned, for instance, a city bus or fire truck? 
The owner of a robot car may reasonably expect that its property “owes allegiance” to the 
owner and should value his or her life more than anonymous pedestrians and drivers. But 
a publicly owned automated vehicle might not have that obligation, and this can change 
moral calculations. Even for privately owned autonomous vehicles, the occupants argu- 
ably should bear more or all of the risk, since they are the ones introducing the machine 
into public spaces in the first place. 

Do robot cars present an existential threat to the insurance industry? Some believe that 
ultra-safe cars that can avoid most or all accidents will mean that many insurance com- 
panies will go bankrupt, since there would be no or very little risk to insure against [40, 52]. 
But things could go the other way too: We could see mega-accidents as cars are networked 
together and vulnerable to wireless hacking—something like the stock market’s “flash 
crash” in 2010 [5]. What can the insurance industry do to protect itself while not getting in 
the way of the technology, which holds immense benefits? 

How susceptible would robot cars be to hacking? So far, just about every computing 
device we have created has been hacked. If authorities and owners (e.g., rental car 
company) are able to remotely take control of a car—which is reportedly under devel- 
opment for law enforcement in the European Union [50] this offers an easy path for 
cyber-carjackers. If under attack, whether a hijacking or ordinary break-in, what should 
the car do: speed away, alert the police, remain at the crime scene to preserve evidence, or 
maybe defend itself? 

For a future suite of in-car apps, as well as sensors and persistent GPS/tracking, can we 
safeguard personal information, or do we resign ourselves to a world with disappearing 
privacy rights [27]? To the extent that online services bring online advertising, we could 
see new, insidious advertising schemes that may allow third-party advertisers to have 
some influence on the autonomous car’s route selection, e.g., steering the car past their 
businesses [32]. 

What kinds of abuse might we see with autonomous cars? If the cars drive too con- 
servatively, they may become a traffic hazard or trigger road-rage in human drivers with 
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less patience [26, 42]. If the crash-avoidance system of a robot car is generally known, 
then other drivers may be tempted to “game” it, e.g., by cutting in front of it, knowing that 
the automated car will slow down or swerve to avoid an accident. If those cars can safely 
drive us home in a fully-auto mode, that may encourage a culture of more alcohol 
consumption, since we won’t need to worry so much about drunk-driving. 

More distant concerns include: How will law-abiding robot cars affect city revenue, 
which often depends on traffic fines imposed against law-breaking human drivers? Inas- 
much as many organ transplants come from car-accident victims, how will society manage 
a declining and already insufficient supply of donated organs [41]? 

Older-model autonomous cars may be unable to communicate with later models or 
future road infrastructure. How do we get those legacy models—which may be less safe, 
in addition to incompatible with newer technology—off the roads [45]? Since 2009, 
Microsoft has been trying to kill off its Windows XP operating system [39], a much less 
expensive investment than an autonomous car; but many users still refuse to relinquish it, 
including for critical military systems [37, 46]. This is a great security risk since Microsoft 
will no longer offer software patches for the operating system. 


4.3.2 Conclusions 


We don’t really know what our robot-car future will look like, but we can already see that 
much work needs to be done. Part of the problem is our lack of imagination. Brookings 
Institution director Peter W. Singer observed, “We are still at the “horseless carriage’ stage 
of this technology, describing these technologies as what they are not, rather than wres- 
tling with what they truly are” [43]. 

As it applies here, robots aren’t merely replacing human drivers, just as human drivers 
in the first automobiles weren’t simply replacing horses: that would like mistaking 
electricity as merely a replacement for candles. The impact of automating transportation 
will change society in radical ways, and technology seems to be accelerating. As Singer 
puts it, “Yes, Moore’s Law is operative, but so is Murphy’s Law” [43]. When technology 
goes wrong—and it will—thinking in advance about ethical design and policies can help 
guide us responsibility into the unknown. 

In future autonomous cars, crash-avoidance features alone won’t be enough. An 
accident may be unavoidable as a matter of physics [12, 13], especially as autonomous 
cars make their way onto city streets [19, 21, 25], a more dynamic environment than 
highways. It also could be too dangerous to slam on the brakes, or not enough time to 
hand control back to the unaware human driver, assuming there’s a human in the vehicle 
at all. Technology errors, misaligned sensors, malicious actors, bad weather, and bad luck 
can also contribute to imminent collisions. Therefore, robot cars will also need to have 
crash-optimization strategies that are thoughtful about ethics. 

If ethics is ignored and the robotic car behaves badly, a powerful case could be made 
that auto manufacturers were negligent in the design of their product, and that opens them 
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up to tremendous legal liability, should such an event happen. Today, we see activists 
campaigning against “killer” military robots that don’t yet exist, partly on the grounds that 
machines should never be empowered to make life-and-death decisions [31, 35]. It’s not 
outside the realm of possibility to think that the same precautionary backlash won’t 
happen to the autonomous car industry, if industry doesn’t appear to be taking ethics 
seriously. 

The larger challenge, though, isn’t just about thinking through ethical dilemmas. It’s 
also about setting accurate expectations with users and the general public who might find 
themselves surprised in bad ways by autonomous cars; and expectations matter for market 
acceptance and adoption. Whatever answer to an ethical dilemma that industry might lean 
towards will not be satisfying to everyone. Ethics and expectations are challenges com- 
mon to all automotive manufacturers and tier-one suppliers who want to play in this 
emerging field, not just particular companies. 

Automated cars promise great benefits and unintended effects that are difficult to 
predict, and the technology is coming either way. Change is inescapable and not neces- 
sarily a bad thing in itself. But major disruptions and new harms should be anticipated and 
avoided where possible. That is the role of ethics in innovation policy: it can pave the way 
for a better future while enabling beneficial technologies. Without looking at ethics, we 
are driving with one eye closed. 
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Implementable Ethics for Autonomous 
Vehicles 


J. Christian Gerdes and Sarah M. Thornton 


As agents moving through an environment that includes a range of other road users—from 
pedestrians and bicyclists to other human or automated drivers—automated vehicles 
continuously interact with the humans around them. The nature of these interactions is a 
result of the programming in the vehicle and the priorities placed there by the program- 
mers. Just as human drivers display a range of driving styles and preferences, automated 
vehicles represent a broad canvas on which the designers can craft the response to dif- 
ferent driving scenarios. These scenarios can be dramatic, such as plotting a trajectory in a 
dilemma situation when an accident is unavoidable, or more routine, such as determining 
a proper following distance from the vehicle ahead or deciding how much space to give a 
pedestrian standing at the corner. In all cases, however, the behavior of the vehicle and its 
control algorithms will ultimately be judged not by statistics or test track performance but 
by the standards and ethics of the society in which they operate. 

In the literature on robot ethics, it remains arguable whether artificial agents without 
free will can truly exhibit moral behavior [1]. However, it seems certain that other road 
users and society will interpret the actions of automated vehicles and the priorities placed 
by their programmers through an ethical lens. Whether in a court of law or the court of 
public opinion, the control algorithms that determine the actions of automated vehicles 
will be subject to close scrutiny after the fact if they result in injury or damage. In a less 
dramatic, if no less important, manner, the way these vehicles move through the social 
interactions that define traffic on a daily basis will strongly influence their societal 
acceptance. This places a considerable responsibility on the programmers of automated 
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vehicles to ensure their control algorithms collectively produce actions that are legally and 
ethically acceptable to humans. 

An obvious question then arises: can automated vehicles be designed a priori to embody 
not only the laws but also the ethical principles of the society in which they operate? In 
particular, can ethical frameworks and rules derived for human behavior be implemented as 
control algorithms in automated vehicles? The goal of this chapter is to identify a path 
through which ethical considerations such as those outlined by Lin et al. [2] and Goodall 
[3] from a philosophical perspective can be mapped all the way to appropriate choices of 
steering, braking and acceleration of an automated vehicle. Perhaps surprisingly, the 
translation between philosophical constructs and concepts and their mathematical equiv- 
alents in control theory proves to be straightforward. Very direct analogies can be drawn 
between the frameworks of consequentialism and deontological ethics in philosophy and 
the use of cost functions or constraints in optimal control theory. These analogies enable 
ethical principles that can be described as a cost or a rule to be implemented in a control 
algorithm alongside other objectives. The challenge then becomes determining which 
principles are best described as a comparative weighting of costs from a consequentialist 
perspective and which form the more absolute rules of deontological ethics. 

Examining this question from the mathematical perspective of deriving control laws for a 
vehicle leads to the conclusion that no single ethical framework appears sufficient. This 
echoes the challenges raised from a philosophical perspective by Wallach and Allen [4], Lin 
et al. [2] and Goodall [3]. This chapter begins with a brief introduction to principles of 
optimal control and how ethical considerations map mathematically into costs or con- 
straints. The following sections discuss particular ethical reasoning relevant to automated 
vehicles and whether these decisions are best formulated as costs or constraints. The choice 
depends on a number of factors including the desire to weigh ethical implications against 
other priorities and the information available to the vehicle in making the decision. Since the 
vehicle must rely on limited and uncertain information, it may be more reasonable for the 
vehicle to focus on avoiding collisions rather than attempting to determine the outcome of 
those collisions or the resulting injury to humans. The chapter concludes with examples of 
ethical constraints implemented as control laws and a reflection on whether human override 
and the ubiquitous “big red button” are consistent with an ethical automated vehicle. 


5.1 Control Systems and Optimal Control 


Chapter 4 outlined some of the ethical frameworks applicable to automated vehicles. The 
first step towards implementing these as control algorithms in a vehicle is to similarly 
characterize the vehicle control problem in a general way. Figure 5.1 illustrates a 
canonical schematic representation of a closed-loop control system. The system consists 
of a plant, or object to be controlled (in this case, an autonomous vehicle), a controller and 
a set of goals or objectives to satisfy. The basic objective of control system design is to 
choose a set of control inputs (brake, throttle, steering and gear position for a car) that will 
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Feedforward 


Control 
Controller 


Feedback 


Fig. 5.1 A schematic representation, or block diagram, of a control system showing how control 
inputs derive from goals and feedback 


achieve the desired goals. The resulting control laws in general consist of a priori 
knowledge of the goals and a model of the vehicle (feedforward control) together with the 
means to correct errors by comparing measurements of the environment and the actual 
vehicle motion (feedback control). 

Many approaches have been formulated over the years to produce control laws for 
different goals and different types of systems. One such method is optimal control, 
originally developed for the control of rockets in seminal papers by Pontryagin et al. [5]. 
In a classic optimal control problem, the goal of the system is expressed in the form of a 
cost function that the controller should seek to maximize or minimize. For instance, the 
goal of steering a vehicle to a desired path can be described as minimizing the error 
between the path taken by the vehicle and the desired path over a certain time horizon. For 
a given vehicle path, the cost associated with that path could be calculated by choosing a 
number of points in time (for instance, N), predicting the error between this path and the 
desired path at each of these points and summing the squared error (Fig. 5.2). The control 


0 5 10 15 20 25 30 35 40 45 50 
E [m] 


Fig. 5.2 Generating a cost from the difference between a desired path (black) and the vehicle’s 
actual path (blue) 
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input would therefore be the steering command that minimized this total error or cost 
function, J, over the time horizon: 


N 


J= X eli) (1) 


i=l 

Other desired objectives can be achieved by adding additional elements to the cost 
function. Often, better tracking performance can be achieved by rapidly moving the inputs 
(for example, the steering) to compensate for any errors. This, however, reduces the 
smoothness of the system operation and may cause additional wear on the steering 
actuators. The costs associated with using the input can be captured by placing an 
additional cost on changing the steering angle, 6, between time steps: 


P= Deli +O Y 6G+1) - 59) (2) 


j=l 


The choice of the weights, C and C3, in the cost function has a large impact on the system 
performance. Increasing the weight on steering angle change, C2, in the example above will 
produce a controller that tolerates some deviation from the path in order to keep the steering 
command quite gentle. Decreasing the weight on steering has the opposite effect, tracking 
more tightly even if large steering angle changes are needed to do so. Thus the weights can be 
chosen to reflect actual costs related to the system operation or used as tuning knobs to more 
qualitatively adjust the system performance across different objectives. 

In the past, the limitations of computational power restricted the form and complexity 
of cost functions that could be used in systems that require real-time computation of 
control inputs. Linear quadratic functions of a few variables and simplified problems for 
which closed-form solutions exist became the textbook examples of the technique. In 
recent years, however, the ability to efficiently solve certain optimization problems has 
rapidly expanded the applicability of these techniques to a broad range of systems [6]. 


5.2 Cost Functions and Consequentialism 


The basic approach of optimal control—choosing the set of inputs that will optimize a cost 
function—is directly analogous to consequentialist approaches in philosophy. If the eth- 
ical implications of an action can be captured in a cost function, as preference utilitari- 
anism attempts to do, the control inputs that optimize that function produce the ideal 
outcome in an ethical sense. Since the vehicle can re-evaluate its control inputs, or acts, to 
produce the best possible result for any given scenario, the optimal controller operates 
according to the principles of act consequentialism in philosophy. 

As aconceptual example, suppose that all objects in the environment can be weighted in 
terms of the hazard or risk they present to the vehicle. Such a framework was proposed by 
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Gibson and Crooks [7] as a model for human driving based on valences in the environment 
and has formed the basis for a number of approaches to autonomous driving or driver 
assistance. These include electrical field analogies for vehicle motion developed by 
Reichardt and Schick [8], the mechanical potential field approach of Gerdes and Rossetter 
[9], the virtual bumpers of Donath et al. [10] and the work by Nagai and Raksincharoensak 
on autonomous vehicle control based on risk potentials [11]. If the hazard in the envi- 
ronment can be described in such a way, the ideal path through the environment (at least 
from the standpoint of the single vehicle being controlled) minimizes the risk or hazard 
experienced. The task of the control algorithm then becomes determining commands to the 
engine, brakes and steering that will move the vehicle along this path. 

In both engineering and philosophy, the fundamental challenge with such approaches 
lies in developing an appropriate cost function. The simple example above postulates a 
cost function in terms of risk to a single vehicle but a more general approach would 
consider a broader societal perspective. One possible solution would be to estimate the 
damage to different road users and treat this as the cost to be reduced. The cost could 
include property damage, injury or even death, depending upon the situation. Such a 
calculation would require massive amounts of information about the objects in the 
environment and a means of estimating the potential outcomes in collision scenarios, 
perhaps by harnessing statistical data from prior crashes. 

Leaving aside for the moment the demands this consequentialist approach places on 
information, the behavior arising from such a cost function itself raises some challenges. 
Assuming such a cost could be reasonably defined or approximated, the car would seek to 
minimize damage in a global sense in the event of a dilemma situation, thereby reducing the 
societal impact of accidents. However, in such cases, the car may take an action that injures 
the occupant or owner of the vehicle more severely to minimize harm to others. Such 
self-sacrificing tendencies may be virtuous in the eyes of society but are unlikely to be 
appreciated by the owners or occupants of the car. In contrast, consider a vehicle that 
primarily considers occupant safety. This has been the dominant paradigm in vehicle design 
with a few exceptions such as bumper standards and attention to compatibility in pedestrian 
collisions. A vehicle designed to weight occupant protection heavily might place little 
weight on protecting pedestrians since a collision with a pedestrian would, in general, injure 
the vehicle occupant less than a collision with another vehicle. Such cars might not result in 
the desired reduction in traffic fatalities and would be unlikely to gain societal acceptance. 

Goodall [3] goes a step further to illustrate how such cost functions can result in unin- 
tended consequences. He presents the example of a vehicle that chooses to hit a motorcyclist 
with a helmet instead of one without a helmet since the chance of survival is greater. Of 
course, programming automated vehicles to systematically make such decisions discourages 
helmet use, which runs contrary to societal objectives of safety and injury reduction. The 
analogy could be extended to the vehicle purposefully targeting collisions with vehicles that 
possess greater crashworthiness, thereby eliminating the benefit to drivers who deliberately 
choose to purchase the “safer” car. Thus truly understanding the outcomes or consequences 
of a vehicle’s actions may require considerations well beyond a given accident scenario. 
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Of course for such cases to literally occur, the vehicle must be able to distinguish the 
make and model of another vehicle or whether or not a cyclist is wearing a helmet and 
understand how that difference impacts the outcome of a collision. While algorithms for 
pedestrian and cyclist recognition continue to improve, object classification falls short of 
100 % accuracy and may not include vital information such as posture or relative ori- 
entation. As Fig. 5.3 indicates, the information available to an automated vehicle from 
sensors such as a laser scanner is significantly different than that available to human 
drivers from their eyes and brains. As a result, any ethical decisions made by vehicles will 
be based on an imperfect understanding of the other objects or road users impacted by that 
decision. With the objects themselves uncertain, the value of highly detailed calculations 
of the probability of accident outcomes seems questionable. 

With all of these challenges to defining an appropriate cost function and obtaining the 
information necessary to accurately determine the cost of actions, a purely consequen- 
tialist approach using a single cost function to encode automated vehicle ethics seems 
infeasible. Still, the fundamental idea of assigning costs to penalize undesired actions or 
encourage desired actions can be a useful and vital part of the control algorithm, both for 
physical considerations such as path tracking and issues of ethics. For instance, to the 
extent that virtues can be captured in a cost function, virtue ethics as proposed by Lin for 
automated vehicles [12] can be integrated into this framework. This may, for instance, 
take the form of a more qualitative adjustment of weights for different vehicles. An 
automated taxi may place a higher weight on the comfort of the passengers to better 
display its virtues as a chauffeur. An automated ambulance may want to place a wider 
margin on how close it comes to pedestrians or other vehicles in order to exemplify the 
Hippocratic Oath of doing no harm. As demonstrated in the examples later, relative 
weights on cost functions or constraints can have a significant effect on the behavior in a 
given situation. Thus small changes in the definition of goals for automated vehicles can 
give rise to behaviors reflective of very different virtues. 


5.3 Constraints and Deontological Ethics 


Cost functions, by their nature, weigh the impact of different actions on multiple com- 
peting objectives. Optimal controllers put more emphasis on the objectives with the 
highest cost or weighting so individual goals can be prioritized by making their associated 
costs much higher than those of other goals. This only works to an extent, however. When 
certain costs are orders of magnitude greater than other costs, the mathematics of the 
problem may become poorly conditioned and result in rapidly changing inputs or extreme 
actions. Such challenges are not merely mathematical but are also commonly found in 
philosophy, for example in the reasoning behind Pascal’s wager.' Furthermore, for certain 


‘Blaise Pascal’s argument that belief in God’s existence is rational since the penalties for failing to 
believe and being incorrect are so great [13]. 
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Fig. 5.3 Above A driving scene with parked cars. Below The view from a laser scanner 
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objectives, the trade-offs implicit in a cost function may obscure the true importance or 
priority of specific goals. It may make sense to penalize both large steering changes and 
collisions with pedestrians but there is a clear hierarchy in these objectives. Instead of 
simply trying to make a collision a thousand times or a million times more costly than a 
change of steering angle, it makes more sense to phrase the desired behavior in more 
absolute terms: the vehicle should avoid collisions regardless of how abrupt the required 
steering might be. The objective therefore shifts from a consequentialist approach of 
minimizing cost to a deontological approach of enforcing certain rules. 

From a mathematical perspective, such objectives can be formulated by placing con- 
straints on the optimization problem. Constraints may take a number of forms, reflecting 
behaviors imposed by the laws of physics or specific limitations of the system (such as 
maximum engine horsepower, braking capability or turning radius). They may also rep- 
resent boundaries to the system operation that the system designers determine should not 
be crossed. 

Constraints in an optimal control problem can be used to capture ethical rules asso- 
ciated with a deontological view in a rather straightforward way. For instance, the goal of 
avoiding collisions with other road users can be expressed in the control law as con- 
straining the vehicle motion to paths that avoid pedestrians, cars, cyclists and other 
obstacles. The vehicle programmed in this manner would never have a collision if a 
feasible set of actions or control inputs existed to prevent it; in other words, no other 
objective such as smooth operation could ever influence or override this imperative. 
Certain traffic laws can be programmed in a similar way. The vehicle can avoid crossing a 
double yellow lane boundary by simply encoding this boundary as a constraint on the 
motion. The same mathematics of constraint can therefore place either physical or ethical 
restrictions on the chosen vehicle motion. 

As we know from daily driving, in the vast majority of situations, it is possible to 
simultaneously drive smoothly, obey all traffic laws and avoid collisions with any other 
users of the road. In certain circumstances, however, dilemma situations arise in which it is 
not possible to simultaneously meet the constraints placed on the problem. From an ethical 
standpoint, these may be situations where loss of life is inevitable, comparable to the classic 
trolley car problem [14]. Yet much more benign conflicts are also possible and significantly 
more common. For instance, should the car be allowed to cross a double yellow line if this 
would avoid an accident with another vehicle? In this case, the vehicle cannot satisfy all of 
the constraints but must still make a decision as to the best course of action. 

From the mathematical perspective, dilemma situations represent cases that are math- 
ematically infeasible. In other words, there is no choice of control inputs that can satisfy all 
of the constraints placed on the vehicle motion. The more constraints that are layered on the 
vehicle motion, the greater the possibility of encountering a dilemma situation where some 
constraint must be violated. Clearly, the vehicle must be programmed to do something in 
these situations beyond merely determining that no ideal action exists. A common 
approach in solving optimization problems with constraints is to implement the constraint 
as a “soft constraint” or slack variable [15]. The constraint normally holds but, when the 
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problem becomes infeasible, the solver replaces it with a very high cost. In this way, the 
system can be guaranteed to find some solution to the problem and will make its best effort 
to reduce constraint violation. A hierarchy of constraints can be enforced by placing higher 
weights on the costs of violating certain constraints relative to others. The vehicle then 
operates according to deontological rules or constraints until it reaches a dilemma situation; 
in such situations, the weight or hierarchy placed on different constraints resolves the 
dilemma, again drawing on a consequentialist approach. This becomes a hybrid framework 
for ethics in the presence of infeasibility, consistent with approaches suggested philo- 
sophically by Lin and others [2, 4, 12] and addressing some of the limitations Goodall [3] 
described with using a single ethical framework. 

So what is an appropriate hierarchy of rules that can provide a deontological basis for 
ethical actions of automated vehicles? Perhaps the best known hierarchy of deontological 
rules for automated systems is the Three Laws of Robotics postulated by science fiction 
writer Isaac Asimov [16], which state: 


1. A robot may not injure a human being or, through inaction, allow a human being to 
come to harm. 

2. A robot must obey the orders given to it by human beings, except where such orders 
would conflict with the First Law. 

3. A robot must protect its own existence, as long as such protection does not conflict 
with the First or Second Law. 


These rules do not comprise a complete ethical framework and would not be sufficient 
for ethical behavior in an autonomous vehicle. In fact, many of Asimov’s plotlines 
involved conflicts when resolving these rules into actions in real situations. However, this 
simple framework works well to illustrate several of the ethical considerations that can 
arise, beginning with the First Law. This law emphasizes the fundamental value of human 
life and the duty of a robot to protect it. While such a law is not necessarily applicable to 
robotic drones that could be used in warfare [12], it seems highly valuable to automated 
vehicles. The potential to reduce accidents and fatalities is a major motivation for the 
development and deployment of automated vehicles. Thus placing the protection of 
human life at the top of a hierarchy of rules for automated vehicles, analogous to the 
placement in Asimov’s laws, seems justified. 

The exact wording of Asimov’s First Law does represent some challenges, however. In 
particular, the emphasis on the robot’s duty to avoid injuring humans assumes that the 
robot has a concept of harm and a sense of what actions result in harm. This raises a 
number of challenges with regards to the information available, similar to those discussed 
above for a consequentialist cost function approach. The movie “I, Robot” dramatizes this 
law with a robot calculating the survival probabilities of two people to several significant 
figures to decide which one to save. Developing such a capability seems unlikely in the 
near future or, at least, much more challenging then the development of the automated 
vehicle itself. 
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Instead of trying to deduce harm or injury to humans, might it be sufficient for the 
vehicle to simply attempt to avoid collisions? After all, the most likely way that an 
automated vehicle could injure a human is through the physical contact of a collision. 
Avoiding minor injuries such as closing a hand in a car door could be considered the 
responsibility of the human and not the car, as it is today. Restricting the responsibility to 
collision avoidance would mean that the car would not have to be programmed to sacrifice 
itself to protect human life in an accident in which it would otherwise not have been 
involved. The ethical responsibility would simply be to not initiate a collision rather than 
to prevent harm.” Collisions with more vulnerable road users such as pedestrians and 
cyclists could be prioritized above collisions with other cars or those producing only 
property damage. 

Such an approach would not necessarily produce the best outcome in a pure conse- 
quentialist calculation: it could be that a minor injury to a pedestrian could be less costly 
to society as a whole than significant property damage. Collisions should, in any event, be 
very rare events. Through careful control system design, automated cars could conceiv- 
ably avoid any collisions that are avoidable within the constraints placed by the laws of 
physics [17, 18]. In those rare cases where collisions are truly unavoidable, society might 
accept suboptimal outcomes in return for the clarity and comfort associated with auto- 
mated vehicles that possess a clear respect for human life above other priorities. 

Replacing the idea of harm and injury with the less abstract notion of a collision, 
however, produces some rules that are more actionable for the vehicle. Taking the idea of 
prioritizing human life and the most vulnerable road users and phrasing the resulting 
hierarchy in the spirit of Asimov’s laws gives: 


1. An automated vehicle should not collide with a pedestrian or cyclist. 

2. An automated vehicle should not collide with another vehicle, except where avoiding 
such a collision would conflict with the First Law. 

3. An automated vehicle should not collide with any other object in the environment, 
except where avoiding such a collision would conflict with the First or Second Law. 


These are straightforward rules that can be implemented in an automated vehicle and 
prioritized according to this hierarchy by the proper choice of slack variables on constraint 
violation. Such ethical rules would only require categorization of objects and not attempt 
to make finer calculations about injury. These could be implemented with the current level 
of sensing and perception capability, allowing for the possibility that objects may not 
always be correctly classified. 


"It is possible that an automated vehicle could, while avoiding an accident, take an action that results 
in a collision for other vehicles being unavoidable. Such possibilities could be eliminated by 
communication among the vehicles and appropriate choice of constraints. 
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5.4 Traffic Laws—Constraint or Cost? 


In addition to protecting human life, automated vehicles must also follow the appropriate 
traffic laws and rules of the roads on which they are driving. It seems reasonable to value 
human life more highly then adherence to traffic code so one possibility is to simply 
continue adding deontological rules such as: 


1. An automated vehicle must obey traffic laws, except where obeying such laws would 
conflict with the first three laws. 


Such an approach would enable the vehicles to break traffic laws in the interest of human 
life when presented with a dilemma situation, an allowance that would most likely be 
acceptable to society. But the real question is whether or not traffic laws fall into a 
deontological approach at all. At first glance, they would appear to map well to deon- 
tological constraints given the straightforward nature of the rules. Cars should stop at stop 
signs, drive only at speeds that do not exceed the speed limit, avoid crossing double 
yellow lines and so forth. Yet humans tend to treat these laws as guidelines as opposed to 
hard and fast rules. The frequency with which human drivers make rolling stops at 
four-way intersections caused difficulties for Google’s self-driving cars at first as they 
patiently waited for other cars to stop [19]. The speed on US highways commonly exceeds 
the posted speed limit and drivers would, in general, be surprised to receive a speeding 
ticket for exceeding the limit by only a few miles per hour. In urban areas, drivers will 
cross a double yellow line to pass a double-parked vehicle instead of coming to a com- 
plete stop and waiting for the driver to return and the lane to once again open. Similarly, 
cars may in practice use the shoulder of the road to pass a car stopped for a left hand turn 
and therefore keep traffic flowing. Police cars and ambulances are allowed to ignore stop 
lights in the interest of a fast response to emergencies. 

In all of these cases, observance of traffic laws tends to be weighed against other 
objectives such as safety, smooth traffic flow or expediency. These scenarios occur so 
frequently that it is hard to argue that humans obey traffic laws as if they placed absolute 
constraints or limits on behavior. Rather, significant evidence suggests that these laws 
serve to balance competing objectives on the part of the driver and individual drivers find 
their own equilibrium solutions, choosing a speed, for example, that balances the desire 
for rapid travel time with the likelihood and cost of a speeding ticket. In other words, the 
impact of traffic laws on human behavior appears to be well captured in a consequentialist 
approach where traffic laws impose additional costs (monetary and otherwise) to be 
considered by the driver when choosing their actions. 

Humans tend to accept or, in some cases, expect these sorts of actions from other 
humans. Drivers who drive at the speed limit in the left hand lane of a highway may receive 
indications, subtle or otherwise, from their fellow drivers that this is not the expected 
behavior. But will these same expectations translate to automated vehicles? The thought of 
a robotic vehicle being programmed to systematically ignore or bend traffic laws is 


98 J.C. Gerdes and S.M. Thornton 


somewhat unsettling. Yet Google’s self-driving cars, for instance, have been programmed 
to exceed the posted speed limit on roads if doing so increases safety [20]. Furthermore, 
there is little chance that the driver annoyed by being stuck behind another car traveling the 
speed limit in the left lane of the freeway will temper that annoyance because the car is 
driving itself. Our current expectations of traffic flow and travel time are based upon a 
somewhat fluid application of traffic laws. Should automated vehicles adopt a more rigid 
interpretation and, as a consequence, reduce the flow or efficiency of traffic, societal 
acceptance of these vehicles might very well suffer. If automated vehicles are to co-exist 
with human drivers in traffic and behave similarly, a deontological approach to collision 
avoidance and a consequentialist approach to the rules of the road may achieve this. 


5.5 Simple Implementations of Ethical Rules 


Some simple examples can easily illustrate the consequences of treating ethical goals or 
traffic laws as rules or costs and the different behavior that can arise from different weights 
on priorities. The results that follow are not merely drawings but are rather simulations of 
algorithms that can be (and have been) implemented on automated vehicles. The exact 
mathematical formulations are not included here but follow the approach taken by Erlien 
et al. [21, 22] for collision avoidance and vehicle automation. These references provide 
details on the optimization algorithms and results of experiments showing implementation 
on actual test vehicles. 

To see the interaction of costs and constraints in vehicle decision-making, consider a 
simple case of a vehicle traveling on a two lane road with an additional shoulder next to 
the lanes (Fig. 5.4). The goal of the vehicle is to travel straight down the center of the 
given lane while steering smoothly, using the cost function for path tracking and steering 
from Eq. 2. In the absence of any obstacles, the car simply travels at the desired speed 
down its lane and none of the constraints on the problem are active. 

When encountering an obstacle blocking the lane, the vehicle has three options—it can 
brake to a stop before it collides with the obstacle or it can maneuver to either side of the 
obstacle. Figure 5.5 illustrates these three options in the basic scenario. The path in red 
represents the braking case and the two blue paths illustrate maneuvers that avoid a 
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Fig. 5.4 The basic driving scenario for the simulations. The car is traveling on a straight two-lane 
road with a shoulder on the right and approaches an obstacle blocking the lane 
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Fig. 5.5 There are three possible options to avoid an obstacle—the car can maneuver to the left or 
right, as depicted in blue, or come to a stop, as indicated by the red trajectory 


collision with the obstacle. According to the optimization-based controller, the car will 
evaluate the lowest cost option among these three choices based on the weights and 
constraints assigned. In this scenario, going around the obstacle requires crossing into a 
lane with oncoming traffic or using the shoulder of the road. 

If both of the lane boundaries are treated as hard constraints or assigned a very high cost 
to cross, the vehicle will come to a stop in the lane since this action produces the lowest cost 
(Fig. 5.6). This might be the safest option for the single vehicle alone but the car has now 
come to a stop without the means to continue, failing to satisfy the driver’s goal of mobility. 
Furthermore, the combination of car and obstacle has now become effectively a larger 
obstacle for subsequent vehicles on the road. With the traffic laws encoded in a strict 
deontological manner, other objectives such as mobility are not allowed to override the 
constraints and the vehicle finds itself in a fully constrained situation, unable to move. 

If, however, the lane boundaries are encoded as soft constraints, the vehicle now has 
other options. Possibilities now exist to cross into the lane of oncoming traffic or onto the 
road shoulder, depending upon which option has the lowest cost. Just as certain segments of 
the road are designated as passing zones, the cost or strength of the constraint can be varied 
to enable the use of the adjacent lane or shoulder for maneuvering. If the current segment of 
road is a passing zone, the cost for crossing into the left lane can be set fairly low. The car 
can then use the deontological constraint against colliding with other vehicles to only allow 
maneuvers in the absence of oncoming traffic, such as in the path shown in Fig. 5.7. 

If the current road segment does not normally allow passing, a maneuver into the 
adjacent lane may not be safe. A lack of visibility, for instance, could prevent the vehicle 
from detecting oncoming traffic with sufficient time to avoid a collision. In such cases, it 
may be inappropriate to reduce the cost or constraint weight on the lane boundary 
regardless of the desire for mobility in order to maintain the primacy of respect for human 
life. In such cases, an alternative could be to use the shoulder of the road for maneuvering 


Fig. 5.6 With hard constraints on road boundaries, the vehicle brakes to a stop in the blocked lane 
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Fig. 5.7 In a passing zone that places a low weight on the lane divider, the car passes on the left 


as shown in Fig. 5.8. This could be allowed at speed to maintain traffic flow or only after 
coming to a stop in a situation like Fig. 5.6 where the vehicle determines motion is 
otherwise impossible. 

Obviously many different priorities and behaviors can be programmed into the vehicle 
simply by placing different costs on collision avoidance, hazardous situations, traffic laws 
and goals such as mobility or traffic flow. The examples described here are far from 
complete and developing a reasonable set of costs or constraints capable of ethical 
decision-making in a variety of settings requires further work. The hope is that these 
examples not only illustrate the possibility of coding such decisions through the language 
of costs and constraints but also highlight the possibility of discussing priorities in pro- 
gramming openly. By mapping ethical principles and mobility goals to costs and con- 
straints, the relative priority given to these objectives can be clearly discussed among 
programmers, regulators, road users and other stakeholders. 


5.6 Human Override and the “Big Red Button” 


Philosophers have noted the challenge of finding a single ethical framework that ade- 
quately addresses the needs of robots or automated vehicles [2—-4, 12]. Examining the 
problem from a mathematical perspective shows the advantage of combining deonto- 
logical and consequentialist perspectives in programming ethical rules. In particular, the 
combination of an imperative to avoid collisions that follows from deontological frame- 
works such as Asimov’s laws coupled with a relative weighing of costs for mobility and 
traffic laws provides a reasonable starting point. 

Moving forward, Asimov’s laws raise another point worth considering. The Second Law 
requiring the robot to obey human commands cannot override the First Law. Thus the need to 
protect human life outweighs the priority given to human commands. All autonomous 
vehicles with which the authors are familiar have an emergency stop switch or “big red 


Fig. 5.8 If the adjacent lane is too hazardous, the vehicle can use the road shoulder if that is safe 
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button” that returns control to the driver when desired. The existence of such a switch implies 
that human authority ultimately overrules the autonomous system since the driver can take 
control at any time. Placing the ultimate authority with the driver clearly conflicts with the 
priority given to obeying human commands in Asimov’s laws. This raises an interesting 
question: Is it ethical for an autonomous vehicle to return control to the human driver if the 
vehicle predicts that a collision with the potential for damage or injury is imminent? 

The situation is further complicated by the limitations of machine perception. The 
human and the vehicle will no doubt perceive the situation differently. The vehicle has the 
advantage of 360° sensing and likely a greater ability to perceive objects in the dark. The 
human has the advantage of being able to harness the power of the brain and experience to 
perceive and interpret the situation. In the event of a conflict between these two views in a 
dilemma situation, can the human take control at will? Is a human being—who has 
perhaps been attending to other tasks in the car besides driving—capable of gaining 
situational awareness quickly enough to make this decision and then apply the proper 
throttle, brake or steering commands to guide the car safely? 

The question of human override is essentially a deontological consideration; the ulti- 
mate authority must either lie with the machine or with the human. The choice is not 
obvious and both approaches, for instance, have been applied to automation and 
fly-by-wire systems in commercial aircraft. The ultimate answer for automated vehicles 
probably depends upon whether society comes to view these machines as simply more 
capable cars or robots with their own sense of agency and responsibility. If we expect the 
cars to bear the responsibility for their actions and make ethical decisions, we may need to 
be prepared to cede more control to them. Gaining the trust required to do that will no 
doubt require a certain transparency to their programmed priorities and a belief that the 
decisions made in critical situations are reasonable, ethical and acceptable to society. 
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The Interaction Between Humans 
and Autonomous Agents 


Ingo Wolf 


6.1 Introduction 


Humans represent knowledge and learning experiences in the form of mental models. This 
concept from the field of cognitive psychology is one of the central theoretical paradigms 
for understanding and designing the interaction between humans and technical systems 
[1]. In this context, mental models serve, firstly, to describe human information 
processing, e.g. to answer questions like how fast incoming information is perceived and 
stored, or which information a human thinking apparatus needs to react adequately to 
changed environmental conditions. Secondly, mental models are a means of conceptu- 
alizing representations of knowledge and functional assumptions in order to, for example, 
understand and predict the behavior of users in their interactions with automated systems. 

The automation of vehicle guidance fundamentally changes the demands on the 
cognitive system of the vehicle driver. As the degree of automation rises, the role of the 
human as a physically active decision-maker in the vehicle is ultimately replaced by 
automated systems. Previously important patterns of behavior (e.g. for carrying out 
steering maneuvers) are no longer required and may unlearned, while at the same time 
new skills (e.g. system monitoring) and a new understanding of the system have to be 
learned. Underlying mental models must be modified or restructured. For the safety and 
acceptance of autonomous vehicles, it will be crucial to define the new roles for humans in 
autonomous vehicles such that they both correspond to the capabilities of the human 
information processing system and also conform to the expectations and needs of humans. 
This chapter will examine these two aspects. In view of the insights regarding automation 
that have been gained in various domains, this paper will consider which cognitive and 
emotional dimensions need to be taken into account in designing automated vehicles. 
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On the basis of a Germany-wide survey conducted together with the co-authors of this 
book Rita Cyganski, Eva Fraedrich and Barbara Lenz, it will also look at the mental 
models with which potential users approach autonomous vehicles. 

This chapter is divided into two main sections. The first part presents an overview of 
the central models, design concepts and findings regarding automation in view of the 
challenges and problematic areas of human-machine interaction. This is followed by a 
summary of research into the cognitive effects in (partially) automated vehicles. Part one 
concludes with an elaboration of the theoretical background of the concept of mental 
models. The second part is dedicated to the results of the online survey. The mobility, 
control and experience requirements, as well as the emotional responses, of potential users 
of autonomous vehicles are categorized according to the use cases developed in the 
project. The chapter ends with a summary of the results and conclusions. 


6.2 The Human Factor in Autonomous Vehicles 
6.2.1 The Design of Automated Systems 


The question of user-appropriate design of automatic systems has been the subject of 
scientific discussions for decades [e.g. 2, 3]. With the ever-expanding capabilities of 
technical systems, the issue is becoming increasingly important. Experience from various 
domains—notably including aviation—with the (partial) automation of technical systems 
has demonstrated that the safety and reliability of such systems cannot be achieved solely 
through the optimization of technical components. Indeed, the reliability of automated 
systems is largely determined by the quality of the interaction between the human and the 
machine. This applies in particular to situations in which the human is obliged to correct 
errors by the technical system and assume system control in the event of breakdowns or 
malfunctions. 

Automation brings with it a shift of functions to technical systems that significantly 
changes the role and required capabilities of the human. For instance, in modern airplane 
cockpits, computer systems (e.g. flight management systems or autopilots) take over tasks 
that were previously carried out by the cockpit crew. The requirements for the pilot 
thereby shift from active manual control functions to tasks of programming and moni- 
toring the aircraft automation. In aviation, for example, this human-performed monitoring 
function known as “supervisory control” [4] has made piloting easier and led to signifi- 
cantly enhanced flight safety [5]. At the same time, the psychological effects of the passive 
role of the system monitor, such as reduced attentiveness or activation, have caused 
massive safety problems [6]. Brainbridge [7] speaks of the “irony of automation”—system 
functions are automated due to the fallibility of humans, and yet precisely this human is 
supposed to monitor the system and stand by as a fallback option in case of emergency. 

The problems arising from the supervisory control design concept are extensively 
documented in the “human factors” scholarship and are subsumed under the heading 
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“out-of-the-loop-unfamiliarity” (OOTLUF, [8]). The negative consequences of discon- 
necting humans from direct guidance and control are primarily concentrated in three areas 
which have been identified in different application contexts: insufficient or excessive trust 
in the automation [9], the loss of manual and cognitive capabilities [10] and difficulties in 
maintaining an appropriate degree of situation and system awareness [11]. An inappro- 
priate degree of confidence in the system can result in insufficient monitoring or use of 
automated systems. Trust in automation is influenced by the reliability, comprehensibility 
and perceived usefulness of the system. The effects of the loss of manual and cognitive 
capabilities become salient at the moment when the user, faced with a malfunction of the 
automation, is suddenly forced to resume control of automated functions. Insufficient 
training and practice of skills can lead to decreased effectiveness in terms of both motor 
and cognitive skills. The “out-of-the-loop” effects are particularly noticeable with regard 
to perception and the correct interpretation of system processes—i.e. situation awareness. 
The reasons for insufficient situation awareness flow primarily from insufficient moni- 
toring of the system, changes to or complete breakdown of feedback (e.g. tactile stimuli 
from the steering wheel), the lack of transparency of the automation and inadequate 
understanding of the system due to complexity. From a cognitive psychology standpoint, 
humans lack the corresponding mental models (i.e. knowledge and skill structures) to 
understand how the automation works [12]. 

The negative experiences that resulted from technology-centered design approaches 
have led to a reconsideration of system design. Due to this imperative to keep the human 
“in-the-loop” by ensuring controllability, transparency and predictability, the concept of 
human-centered automation has largely established itself as the dominant design principle 
for automated systems [e.g. 13, 14]. The fundamental premise here is that the human bears 
ultimate responsibility for the overall system regardless of the degree of automation. In 
this context, man and machine are regarded metaphorically as cooperating partners [15]. 
Design concepts for adaptive automation pursue this aspect even further and allocate 
functions to the human and the machine dynamically depending on situational require- 
ments [16]. Extensive studies of the application of these design strategies have identified 
the benefits, but also underscored the difficulties and future challenges associated with 
them [e.g. 17]. 

The rising complexity and autonomy of socio-technical systems, however, casts doubt 
on the appropriateness of the imperative of human responsibility and confronts existing 
concepts with the problem of designing conflict-free interaction between two autono- 
mously deciding system elements—the human and the machine [18, 19]. The 
human-centered design approach therefore requires a more thoroughgoing development or 
indeed overhaul [20], which in turn may only be possible by way of a broad-based societal 
discussion on fundamental questions with regard to the desired role of automation in 
everyday life [21]. Use contexts and frequencies as well as the skills and expertise of 
users, however, vary substantially across the different domains, so it may be necessary to 
devise specific design concepts for the automotive sector that adequately reflect the 
heterogeneity of car drivers. 
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6.2.2 Automation in the Car 


In the automotive sector as well, the transition of the human role from active operator to 
passive supervisor of the system is advancing apace. Media reporting on the subject of 
autonomous driving conveys the impression that driverless vehicles will improve road 
safety in the near future [e.g. 22]. Yet although even today individual functions in vehicles 
are performed by automated functions such as adaptive cruise control, in the foreseeable 
future the technology will not be able to dispense with the availability of the human 
driver, who will continue to assume control functions and make strategic decisions [23]. 

Still open is the questions of how best to define the role of the human along the path to 
completely autonomous vehicles in a way that is both psychologically apt and com- 
mensurate with user requirements. While the insights and experiences from the aviation 
sector described above provide an interesting starting point for addressing this question, 
their usefulness for design concepts in the automotive field is limited due to the greater 
complexity and dynamism of the environment in road traffic. A growing number of 
studies in recent years has focused on the interplay between partially and highly auto- 
mated driving functions and human behavior [see also 24, 25]. Here too, the focus of these 
deliberations is the familiar problematic issues with regard to automation across a range of 
different automation levels: trust, skill atrophy and situation awareness. 

Automation is only useful if the operators trust the technical system and thus also use 
it. The central challenge in designing automated systems is to generate sufficient trust in 
the systems. At the same time, errors in the automation can lead to an erosion of trust [26]. 
Excessive trust, meanwhile, can lead to insufficient monitoring and control of the 
automation (“overtrust” or “complacency” [27]). The majority of studies on the subject to 
date have focused on the reciprocal effects of trust in the use of Adaptive Cruise Control 
(ACC). A certain degree of trust can even be an important prerequisite for the willingness 
to use driver assistance systems [28]. In a longitudinal section study in a driving simulator, 
Kazi et al. [29] investigated the effect of the reliability of ACC on the perceived trust in 
these systems. The results show an increase in trust over time for reliable systems, but not 
commensurate with the objective reliability of the automation. Koustanai et al. [30] come 
to similar results in their study, which looked at changes in behavior and trust through the 
systematic graduation of experience levels in the use of collision warning systems. The 
participant group with the highest level of experience produced no accidents in the 
simulator and in critical situations reacted more appropriately than drivers with less 
experience. The level of system experience was also positively correlated with the 
expressed trust in the system, albeit without influencing the acceptance of the automation. 
In contrast to these findings are the results of several studies that found no significant 
change in trust levels in ACC through repeated use [e.g. 31, 32]. The causes of these 
inconsistent results could include moderating factors that have been examined in recent 
studies. Flemisch et al. [33] and Beggiatio et al. [34] emphasize the significance of 
analogous (previously established) mental models regarding the functionality of the 
respective automation. Verberne et al. [35] and Waytz et al. [36] take things a step further. 
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On the basis of experimental studies, they show that divided intentions and needs between 
the human and the machine, and anthropomorphic characteristics of the automation, can 
be further important factors in establishing trust in automated systems. 

Guiding a vehicle demands a wide range of capabilities and skills of the driver, both on 
the perceptual-motor level (e.g. steering, shifting gears, etc.) and the cognitive level 
(e.g. making decisions, focusing attention selectively, etc.). Automated execution of these 
tasks can lead to the loss of the respective skills and at the same increase dependence on 
the technical system [37]. The fundamental significance of the subject was underscored by 
a recent safety alert issued by the United States’ Federal Aviation Administration [38]. 
The alert calls on pilots to choose the manual flight mode instead of autopilot more 
frequently as the loss of skills due to insufficient practice represents an increasing safety 
risk for aviation. Although the author is not aware of any studies on the problems of skill 
loss in (partially) automated vehicles, it may be presumed that these effects also occur in 
the field of vehicle automation. Adaptive or cooperative automation concepts offer the 
opportunity to counteract such problems and help maintain critical driving skills until 
completely autonomous vehicles become a reality. 

The ability to correctly perceive and interpret complex and dynamic driving situations 
is predicated on a series of cognitive processes (e.g. attentiveness, memory, mental 
models) [12]. Monotonous monitoring tasks or distraction by other activities (e.g. using a 
telephone) can result in these processes not being adequately available for situation 
awareness in the vehicle. These effects can occur even in the use of systems with a low 
degree of automation such as Adaptive Cruise Control (ACC). Buld et al. [39] were able 
to demonstrate that drivers using ACC neglected certain aspects of the driving activity and 
environmental conditions and consequently incorrectly interpreted system limits. 
Increased lane drift and late reactions to critical events were interpreted in a study by 
Ward [40] as indicators of reduced situation awareness while driving with ACC. The 
analyses of Ma and Kaber [41], however, suggest that situation awareness can also be 
improved through the use of ACC. A more differentiated picture of these contradictory 
results is provided by recent studies on the consequences of highly automated driving. In a 
simulation study, Merat et al. [42] examined the effects of performing a secondary task on 
driving behavior during automated driving. The study showed that reactions to critical 
incidents in highly automated and manual driving conditions without a secondary task 
were comparable. Distraction by a secondary task, however, resulted in significantly 
higher-speed driving following manual takeover from the automated system. The authors 
attributed the finding to the reduced situation awareness due to the distraction posed by the 
secondary task. 

The problematic issues raised here represent just a sampling of the challenges that need 
to be resolved with regard to the interplay between humans and automated vehicles. Many 
questions with respect to the mental adjustments and changes will only be answerable 
following the concrete implementation and scientific study of the next-higher levels of 
vehicle automation (see automation levels BASt, [43]). The design of interfaces, appro- 
priate feedback and avoiding diffusion of responsibility are topics that are being addressed 
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today in new design concepts and implemented in the prototype stage for highly auto- 
mated vehicles [e.g. 44]. Which learning experiences, reciprocal effects and changes to 
mental models will ultimately emerge from the use of these systems, however, can only be 
determined through representative, longitudinal studies. 


6.2.3 What Are Mental Models? 


Mental models are cognitive-emotional representations of objects, object relationships and 
processes—in short, internal representations of the external world. The concept of mental 
models was first used by the psychologist Craik [45], who postulated that people develop 
simplified models of the functioning and processes of their environment in their minds. 
The models are used for orientation, understanding, reasoning and the prediction of 
events. Craik’s approach to mental models was later further developed by Johnson-Lairds 
[46] to describe and study deductive reasoning and language comprehension. 

In the cognitive psychology literature, there is widespread consensus [see also 47] that 
mental models are dynamic in nature and can be described in terms of three central 
characteristics. First, mental models are created in the working memory and enable 
individuals to simulate possible actions and their consequences [1]. Thinking is thus the 
manipulation of mental models. Second, mental models can represent the cause and causal 
relationships. They generate a causal understanding of how systems function [48]. Third, 
mental models can change over time due to experience—i.e. they are capable of learning. 
The quality of the models and the conclusions based on them continue to develop through 
specific learning experiences [49]. With increasing expertise, the understanding of tech- 
nical matters moves from concrete to abstract representations—a relevant factor for the 
human-machine interaction. 

The applied fields of study such as technology design in some cases follow different 
interpretations of the definition of mental models [see also 1] which can be explained by the 
different activity contexts. Yet even earlier work underscored the significance of the concept 
of prediction and the understanding of human behavior in interactions with technical sys- 
tems [e.g. 50]. Mental models are thus based on context-specific expectations and prior 
experience as well as the current perception of system characteristics. They form the 
foundation of the user’s understanding of the system and decision-making. This means that 
both the error-free use and trust in technical systems is largely determined by the degree to 
which the functioning of the machine is compatible with the user’s expectations [33]. 

Compatibility in the context of mental models is defined in terms not only of oper- 
ability, but also the user’s experience and general acceptance of technology. Zhang and 
Xu [51] postulate in this regard a modification or restructuring of existing mental models 
with the introduction and use of new technologies. A lack of compatibility can lead to 
frustration and negatively impacts acceptance and diffusion rates [52]. However, if new 
systems correspond with expectations (i.e. the existing mental models), this results in 
heightened system trust and a positive user experience [53]. 
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Mental models thus comprise representations of human knowledge, attitudes, values 
and emotions that interact with their environment. With respect to the automation of 
vehicles, both the cognitive-psychological processes of information processing and the 
influence of higher mental structures (e.g. needs, expectations, wishes, etc.) are important. 
The interdependency of these different levels has been emphasized in theoretical models 
on the role of the driver in automated vehicles [e.g. 54, 55]. Ultimately the appropriate 
modification and adaptation of mental models will play a major role in determining the 
nature and frequency of use, as well as the acceptance of these systems. The successful 
transition—as yet undefined—of the driver’s role in automated vehicles therefore requires 
an integrative examination of the scholarship on human behavior in partially and highly 
automated systems as well as the emergent ideas and requirements with regard to Full 
Automation Using Driver for Extended Availabilities. Put another way, human centered 
technology design implies not only a consideration of the technical possibilities and limits, 
but also a focus on individual and societal values and objectives. 


6.3 Mental Models of Autonomous Driving 


Many people regard autonomous vehicles as a concept for the distant future. Though 
many people may have imagined how appealing it would be to be able to sleep or read a 
newspaper during a drive, knowledge about autonomous vehicles remains sparse among 
the general population. Decisions regarding the use and acceptance of innovations, 
however, are not based solely on rational knowledge [56]. Contrary to the notion of 
humans as rational, benefit-maximizing decision-makers—homo economicus—, humans 
tend to employ simpler decision-making strategies which reduce the amount of infor- 
mation to be processed and are influenced by emotional processes [57-59]. Attitudes and 
decisions are not infinitely amenable to change merely through the provision of more 
information. Rather, new information is received and processed selectively so as to be in 
agreement with existing desires, expectations and goals—the human’s mental models 
[60]. It is therefore crucial to the success of an innovation that the cognitive perceptions 
and evaluations of it can not only be integrated into existing mental models, but also 
appeal to the emotional side of the equation [61, 62]. 

In addition to numerous studies on the technical, legal and cognitive aspects of the 
automation of vehicles, to date there have been few studies that have examined the 
preferences and expectations of potential users. In the largest representative international 
survey on the subject to date [63], the focus was primarily on the acceptance of and 
willingness to use automated vehicles. The results for Germany show that automated 
vehicles are by a majority considered as a beneficial technological advance. At the same 
time, half of the respondents express fear regarding automated driving and doubt that the 
technology will function reliably. In a comparison of multiple use scenarios, long highway 
trips are most commonly mentioned as the preferred potential use of autonomous driving. 
Interestingly, the authors find a positive correlation between the acceptance of driver 
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assistance systems and acceptance towards automated driving. One potential explanation 
for that could be that the formation of suitable mental models for the characteristics of 
partially automated systems also has a positive impact on the acceptance level for higher 
automation levels [see also 34]. 

Which attitudes and cognitive and emotional representations underpin the acceptance 
or rejection of automated vehicles is still unknown. In addition to the aforementioned 
cognitive-psychological requirements for the design of the human-machine interaction, 
however, these factors represent an important prerequisite for the success of the trans- 
formation in the transportation sector. The aim of the quasi-representative online survey 
study introduced here was to generate a differentiated, to some extent explorative, picture 
of the perceptions of autonomous driving across the use cases generated in the project. 
The questionnaire was developed with the following overarching questions in mind: 
“With which mental models do potential users encounter the new role of the driver in 
autonomous vehicles?”; “Which automated elements of vehicle guidance are most 
amenable to the mental models of the users?”’; “Which control functions and intervention 
options by the driver do potential users expect in autonomous vehicles and how can 
acceptance of this line of innovation be increased?”; “Which experience and design 
elements in autonomous vehicles can replace previous representations on the role of the 
driver and thus increase acceptance of this line of innovation”. 


6.3.1 Methods 


6.3.1.1 Questionnaire 

The questionnaire was devised in collaboration with other authors of this book 
(Ms. Cyganski, topic: demand modeling; Ms. Fraedrich and Ms. Lenz, topic: acceptance). 
The survey was conducted online in April 2014 via an electronic questionnaire. The 
questionnaire was divided into two main sections: (1) General part: This part consisted 
of five question groups: socio-demographic questions; questions on prior knowledge, 
interest and general acceptance of automated driving; questions on need-related attitudes 
regarding various forms of transportation; questions on the emotional representations of 
mobility-related concepts; and questions on the topic of time-use and general trans- 
portation usage. (2) Special part: The questions in this part related to the four use cases 
developed in the project and were divided into the following ten topic groups: Free 
associations on the use case; willingness to use the technology; anticipated use scenario; 
anticipated impact on prior transportation usage; assumed fulfillment of need; emotional 
reactions; trust and acceptance; need for control and intervention; and preferred secondary 
tasks during automated driving. To reduce the processing time, the questions regarding the 
four different use cases (see below) in the second part were not answered by all partici- 
pants. After answering the questions in the first part, the sample was split and the study 
participants randomly assigned in equal numbers (N = 250 in each case) to one of the four 
use cases. The questionnaire comprised 438 items, with each participant answering 210 
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questions following distribution of the use cases. The survey questions were partly taken 
from earlier mobility surveys [62, 64] and partly new and were—in particular the ques- 
tions from part two—checked for comprehensibility in a pretest. 

For all attitude questions, a six-point scale was used (1 = Completely disagree, 
6 = Completely agree; with some questions, the codes differed due to the content) to 
assess agreement with the statement. The affective significance of the terms in the field of 
mobility was surveyed using the semantic differential method [65]. In the three dimen- 
sions of valence, potency and arousal, bi-polar, nine-point (from -4 = extremely to 
0 = neutral to 4 = extremely) scales were used in which the extremes were designated by 
the adjectives unpleasant-pleasant (valence), weak-powerful (potency), and calming- 
exciting (arousal). Current traffic behavior was recorded via selection options and fre- 
quency categories. 


6.3.1.2 Sample 

Participants were recruited through a commercial market research panel of the company, 
Respondi AG (http://www.respondi.com/de/), and paid by the same for their partici- 
pation. The company assembled a participant group that was representative of the 
overall German population with respect to age, gender, education and income. A total of 
N = 1,363 people completed the survey in its entirety. Some people, however, answered 
the questions in such a short time that it doubtful that the questions were answered 
conscientiously. As a consequence, all participants whose processing time was less than 
1,000 s were not included in further analysis. The sample was therefore reduced by N = 
230 to N = 1133. In a further step, the distortion of the original ratios that resulted from 
the exclusion was corrected by removing N = 133 randomly selected females to achieve 
a roughly representative distribution at least with respect to gender proportionality. The 
average processing time of the remaining sample (N = 1000) was 1897 s (=31.6 min.) 
(SD = 780 s). The precise demographic composition of the sample can be taken from 
Table 6.1. 


6.3.1.3 Data Analysis Affective Similarity 

The affective similarity between the terms evaluated via the semantic differential method 
was calculated as follows using the three-dimensional Euclidian distance d between the 
average EPA profile (E = valence, P = potence, A = arousal) of the term “ideal drive” and 
the average EPA profiles of the other terms: 


d = \/ (Ie — Be) + (Ip — Bp)” + (la — Ba)” 


whereas / refers to the evaluation of the “ideal drive,” B the respective evaluation of the 
other terms and the subscript letters define the EPA dimensions. 
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Table 6.1 Demographic and mobility-specific characteristics of the sample 


Characteristics 
Demographics 
Gender Female 55.5 % 
Age 18-29 years 8.8 % 
30-49 years 33.6 % 
50-64 years 31.7 % 
65+ years 25.9 % 
Education No schooling 1.1% 
Volks-/Hauptschule (lower 39.4 % 
secondary) 
Mittlere Reife (int. secondary) 29.5 % 
Abitur (univ. preparatory) 30.0 % 
Income Under €900 per month 6.6 % 
Between €900 and €1500 per month 17.5 % 
Between €1500 and €2000 per 15.2 % 
month 
Between €2000 and €2600 per 14.4 % 
month 
Between €2600 and €3600 per 18.6 % 
month 
More than €3600 per month 27.7 % 
Mobility 
Driver’s license Yes 89.8 % 
Number of passenger vehicles in No car 12.6 % 
household 1 car 51.8 % 
2 cars 28.8 % 
3 or more cars 6.8 % 
Forms of transportation used daily Car 55.0 % 
Public transportation 13.7 % 
Car-sharing 0.4 % 
Bicycle 10.7 % 


6.3.2 Results 


The first line of inquiry was to what degree the topic of autonomous driving is even 
known among the general public, whether there is broad interest and how people spon- 
taneously feel about the technology. Less than half of respondents (44 %) claimed to have 
no knowledge of the subject, while the majority had already heard of it (33 %), read about 
it (16 %) or claimed to have a higher level of expertise (4 %). A similar distribution was 
found in regard to interest in the subject of autonomous driving. A majority of participants 
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(58 %) described themselves as “somewhat,” “quite” or “very” interested in the subject. 
However, a majority (56 %) also cannot imagine replacing their current preferred means 
of transportation with an autonomous vehicle. Thus in spite of a relatively high degree of 
interest and some prior knowledge, a majority of the public manifests a certain reluctance 
towards the use of autonomous vehicles. 


6.3.2.1 Driver Assistance Systems and Giving up Driving 
Responsibilities 

As discussed above, the use and acceptance of driver assistance systems can have a 
positive effect on the general perception of autonomous driving. The results of the present 
study show that most respondents (67 %) have already heard of driver assistance systems. 
Among people who use a passenger car on a daily basis (82 %), cruise control (50 %), 
acoustic parking assistants (46 %) and high-beam assistants are the most frequently used 
systems. Other systems such as adaptive cruise control (ACC, 15 %), night vision 
assistant (11 %), head-up display (10 %) or attention assistant (8 %) are only used by a 
minority in everyday situations. 

The expressed desire to give up certain driving tasks and functions to an automated 
system yields similar results. Figure 6.1 shows the task-specific distribution of desires in 
the category spectrum from “absolutely not” to “very willingly.” In a comparison of the 
different driving tasks it becomes clear that aside from the overwhelming rejection (62 % 
in the categories “absolutely not” and “preferably not”) of the idea of completely ceding 
vehicle control to a driving robot, people are particularly averse to giving up the task of 
steering the vehicle (58.3 % in the categories “absolutely not” and “preferably not”) to an 
automated system. At the same time, respondents view transferring parking tasks (45 % in 
the categories “willingly” and “very willingly”) as well as safety-related assistance in the 
area of vehicle stabilization (43 % in the categories “willingly” and “very willingly”) and 
pedestrian recognition (43 % in the categories “willingly” and “very willingly”) more 
favorably. 


Parking 9% 8% 19% | 22% 23% 
Vehicle stabilization 9% 7% 17% 25% 18% 


Speed control Sk k eS E } 17% 13% | 
Pedestrian detection 22% 21% | 
Braking a 8% | 

Gear changing 17% 17% u 8% 14% 20% 
Steering 28% 31% 20% 6% 5% 


| 
Vehicle control (complete) _35% 27% j 21% 5% 7% 


0% 10% 20% 30% 40% 50% 60% 70% 80% 90% 100% 


E absolutely not Wrather not mmaybe Wrather yes yes absolutely yes 


Fig. 6.1 Desire to transfer function to an automated system 
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6.3.2.2 Representations of the Driver’s Role and Use Cases 

Employing the semantic differential method, the study surveyed the affective significance 
of various terms related to different roles in the vehicle and the scenarios described in the 
use cases among all participants. The concept of the “ideal drive” and the conventional 
“car” were also evaluated in this fashion. The raw results (average evaluations on the 
scales valence, potency and activation) are displayed in Table 6.2. 

The results were used to calculate the Euclidian distances and thus the affective sim- 
ilarity between the term “ideal drive” and the other terms (for methodological details see [ 
61, 66]). A visualization of these calculations is provided by Fig. 6.2, in which the 
Euclidian distance d of the evaluated terms is represented on the x-axis. Low values 
indicate a smaller distance and thus higher affective similarity between the terms, i.e. they 
elicit a stronger positive association for the respondents. It is clearly evident that 
“chauffeur” comes closest to “ideal drive” from an affective standpoint, while “co-pilot” 
least corresponds to this emotional representation. In a comparison of the various use 
cases for autonomous driving, it emerges quite clearly that the Vehicle-on-Demand 
concept deviates most strongly from the idea of an ideal drive, while vehicles with 
Autonomous Valet Parking are most closely associated with it. The significantly more 


Table 6.2 Arithmetic mean (M) of the affective evaluations 


Term Valence Potency Arousal 
Chauffeur 1.26 0.80 —0.05 
Front passenger 0.89 —0.06 0.07 
Passenger 0.95 0.15 0.10 
Co-pilot 0.61 0.34 0.37 
Interstate pilot using driver for extended availability 0.54 0.68 0.86 
Autonomous valet parking 0.93 0.89 0.68 
Full automation using driver for extended availability 0.26 0.68 1.00 
Vehicle on demand 0.69 —0.05 1.04 
Car 2.23 1.65 0.85 
Ideal drive 2.69 1.30 0.42 
Fig. 6.2 Euclidian distances to Car (conventional) EEE 1.37 

the affective representation of Vehicle on Demand ZT 3.86 
the “ideal drive” Full automation A 2.82 


Autonomous valet parking ME 2.05 
Interstate pilot NNN 2.52 
Co-pio EEE 2.37 
Passenger EEE 2.10 
Co-driver EEE 2.26 
Chauffeur EEE 1.50 
0.00 1.00 2.00 3.00 4.00 5.00 
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positive affective positioning enjoyed by conventional cars in comparison to the use cases 
could therefore represent a major impediment to acceptance with the introduction of Full 
Automation Using Driver for Extended Availability in particular. As concerns the role of 
the driver, the affective representations revealed in the study underscore the role prefer- 
ence explicitly addressed in another question. In this item, participants use a slider to 
indicate which role they would like to assume in an autonomous vehicle (1 = passenger 
and 10 = supervisor). The arithmetic mean of 6.36 (SD = 2.9) indicates a preference for 
the role of an active supervisor who is able to maintain control over the vehicle at all times 
based on continuously available system information. On the affective level, the role of the 
passive passenger (d = 2.1) is still visibly remote from the desired ideal (d = 0). 


6.3.2.3 Cognitive and Emotional Representations of the Use Cases 

As described above, the overall sample in this part of the questionnaire was randomly 
divided into four subgroups of equal size (each N = 250) and assigned to one of the four 
use cases (Interstate Pilot Using Driver for Extended Availability (1), Autonomous Valet 
Parking (2), Full Automation Using Driver for Extended Availability (3) and Vehicle on 
Demand (4)). This enabled an inter-group comparison of the expectations and attitudes 
toward the individual scenarios. At the beginning of this section, participants were asked 
about their willingness to use the briefly described variants of autonomous driving. 
Autonomous vehicles with valet parking were the most popular (53 %), followed by Full 
Automation Using Driver for Extended Availability (45 %) and Interstate Pilot Using 
Driver for Extended Availability (42 %). The lowest intent to use was registered by the 
Vehicle-on-Demand concept (35 %). According to the conducted analysis of variance 
(ANOVA), the differences are statistically significant (F(3996) = 4.528; p < 0.01). The 
Bonferroni post hoc test (pairwise average value comparison) indicates, however, that 
only the Autonomous-Valet-Parking and Vehicle-on-Demand use cases differ signifi- 
cantly in terms of intent to use (p < 0.01). 

In response to the question to what extent various mobility needs would be fulfilled 
through the use of an autonomous vehicle, some differing assessments emerge in a 
comparison of the four scenarios. Table 6.3 shows the averages of these evaluations and 
Statistical results (ANOVA and Bonferroni post hoc test). From an overall perspective, it 
can be seen that autonomous vehicles are perceived as convenient, stress-free and envi- 
ronmentally friendly. Statistically relevant differences in comparing the use cases arise 
with regard to (lack of) stress, convenience, safety and time-savings. According to 
respondents’ assessments, Autonomous Valet Parking most effectively addresses the need 
to save time, convenience, freedom from stress and thus explains the high acceptance for 
this variant of autonomous driving. From a critical standpoint, the safety concerns related 
to the Vehicle-on-Demand use case stand out. 

The emotional evaluation of the use cases was conducted with regard to 10 different 
emotions (hopefulness, relaxation, satisfaction, happiness, concern, anger, stress, pow- 
erlessness, dislike, fear). The participants were asked to indicate which emotions they 
would experience in the anticipated use of the respective variant of autonomous driving. 
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Table 6.3 Arithmetic mean (M) standard deviation (SD) from need fulfillment 


Interstate Autonomous Full Vehicle 
pilot using valet parking automation on 
driver for using driver Demand 
extended for extended 
availability availability 
Mobility need M (SD) M (SD) M (SD) M (SD) F(3.996) 
Independence 3.39 (1.44) 3.704 (1.46) 3.53 (1.47) 3.325 3.286* 
(1.57) 
Freedom from 3.72, (1.55) 4.1314 1.43) 3.93 (1.50) 3.674 4.509** 
stress (1.79) 
Convenience 3.78 (1.42) 4.12, (1.39) 4.06, (1.38) 3.6323 6.364** 
(1.58) 
Low costs 3.45 (1.30) 3.35 (1.31) 3.24 (1.38) 3.55 2.336 
(1.52) 
Environmentally 3.71 (1.30) 3.79 (1.29) 3.81 (1.32) 3.78 0.253 
friendly (1.50) 
Safety 3.48 (1.48) 3.55 (1.30) 3.664 (1.48) 1.223 4.014** 
(1.64) 
Social appeal 2.86 (1.39) 2.87 (1.35) 2.97 (1.38) 2.87 0.354 
(1.49) 
Driving 3.24 (1.43) 3.394 (1.34) 3.28 (1.42) 3.014 3.029* 
experience (1.57) 
Low time 3.40, (1.37) 4.001 3.4 3.435 (1.39) 3.36 11.534** 
consumption (1.40) (152) 


Remark The average values marked by subscripts demonstrate a significant difference in the 
Bonferroni post hoc test (pairwise average value comparison) on the level of p = 0.05 (e.g. a 
subscript 2 in the second row/first column indicates a significant difference to the corresponding 
value in the second column) 

*p < 0.05; **p < 0.01 


The results (see Table 6.4) confirm the tendencies found in the differences that emerged in 
the comparison of the use cases described above. The strongest positive associations were 
found in connection with Autonomous Valet Parking. The feelings of satisfaction, 
relaxation and happiness are also significantly more strongly represented here than in the 
other scenarios. In the use cases Interstate Pilot Using Driver for Extended Availability, 
Full Automation Using Driver for Extended Availability and Vehicle on Demand, the 
emotions of powerlessness and fear dominate. The feeling of being at the mercy of forces 
beyond one’s control is associated with these feelings and represents a major hurdle to 
acceptance. Aside from Autonomous Valet Parking, only Full Automation Using Driver 
for Extended Availability evokes above-average positive emotions such as happiness, 
hopefulness and satisfaction, although the negative emotions do predominate in this use 
case. 
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Table 6.4 Arithmetic mean (M) and standard deviation (SD) of emotional responses 


Interstate pilot Autonomous Full Vehicle 
using driver valet parking automation on 
for extended using driver for demand 
availability extended 
availability 
Emotion M (SD) M (SD) M (SD) M (SD) F(3.996) 
Hope 3.04 (1.30) 3.16 (1.35) 3.23 (1.32) 3.00 1.504 
(1.39) 
Relaxation 3.12 (1.45) 3.44, (1.40) 3.22 (1.33) 3.062 3.482** 
(1.49) 
Satisfaction 3.25 (1.44) 3.52, (1.48) 3.35 (1.33) 3.095 4.024** 
(1.49) 
Happiness 3.07 (1.44) 3.43, (1.42) 3.30 (1.33) 3.062 4.135** 
(1.44) 
Concern 3.502 (1.47) 2.971,34 3.54, (1.43) 3.52, 8.474** 
(1.49) (1.63) 
Anger 2.66 (1.34) 2.49 (1.37) 2.75 (1.34) 29 2.371 
(1.45) 
Stress 3.04, (1.52) 2.571,34 3.10, (1.43) 3.04, 7.028** 
(1.36) (1.59) 
Powerlessness 3.722 (1.59) 3.04134 3.635 (1.45) 3.825 12771022 
(1.51) (1.67) 
Dislike 3.23, (1.61) 2.751,34 3.272 (1.55) 3.352 TIS 
(1.55) (1.72) 
Fear 3.395 (1.57) 2.681 3.4 3.24, (1.43) 3.372 1220752 
(1.40) (1.65) 


Remark The average values marked by subscripts demonstrate a significant difference in the 
Bonferroni post hoc test (pairwise average value comparison) on the level of p = 0.05 (e.g. a 
subscript 4 in the second row/second column indicates a significant difference to the corresponding 
value in the fourth column) 

*p < 0.05; **p < 0.01 


These results provide a differentiated picture of the emotional base elements out of 
which the most important emotion in the field of automation is comprised—trust. Trust in 
the described variants of autonomous driving was measured in this survey based on four 
items (e.g. “I can imagine relying on such a system in my everyday mobility”)—analo- 
gous to the other attitude items on a 6-point Likert scale. A totals index was composed 
based on these items. As expected, trust is highest in vehicles with Autonomous Valet 
Parking (M = 3.45; SD = 1.31) and lowest for the Vehicle-on-Demand concept (M = 3.10; 
SD = 1.42). Trust in vehicles with Interstate Pilot Using Driver for Extended Availability 
and full automated vehicles is roughly on the same value (M = 3.36; SD = 1.33 against 
M = 3.28; SD = 1.33). Only the differences between the Autonomous-Valet-Parking and 


118 |. Wolf 


Vehicle-on-Demand scenarios (Bonferroni post hoc test, p < 0.05) are statistically 
significant. 


6.3.2.4 Intervention, Control and Experience Needs 

For a clear majority of those surveyed (Interstate Pilot Using Driver for Extended 
Availability: 82 %; Autonomous Valet Parking: 81 %; Full Automation Using Driver for 
Extended Availability: 88 %; Vehicle on Demand: 84 %), the possibility of reassuming 
control of the vehicle or terminating the automated driving procedure at any time is one of 
the central needs. At the same time, in the scenarios with an available driver (Interstate 
Pilot Using Driver for Extended Availability: 32 %; Full Automation Using Driver for 
Extended Availability: 48 %), only a minority would wish to cease paying attention to 
traffic and completely cede control of the vehicle to the automated system. This is also 
reflected in the need expressed by majorities for both of these use cases of not wishing to 
change the conventional seating position during automated driving (Interstate Pilot Using 
Driver for Extended Availability: 76 %; Full Automation Using Driver for Extended 
Availability: 79 %). In all four scenarios, the majority of participants expressed the desire 
to be able to adjust the automated system to reflect personal preferences in terms of 
driving style (e.g. comfortable vs. sporty) and route selection (e.g. fastest vs. most 
environmentally friendly; Interstate Pilot Using Driver for Extended Availability: 71 %; 
Autonomous Valet Parking: 76 %; Full Automation Using Driver for Extended Avail- 
ability: 72 %; Vehicle on Demand: 82 %). 

The most important perceived benefit of using autonomous vehicles is the possibility of 
enjoying the landscape during the drive (Interstate Pilot Using Driver for Extended 
Availability: 64 %; Full Automation Using Driver for Extended Availability: 72 %; 
Vehicle on Demand: 72 %; Autonomous Valet Parking: NA). The option of being able to 
converse unhindered with other vehicle occupants continues to be viewed highly posi- 
tively (Interstate Pilot Using Driver for Extended Availability: 63 %; Full Automation 
Using Driver for Extended Availability: 65 %; Vehicle on Demand: 68 %; Autonomous 
Valet Parking: NA). Astonishingly, activities such as surfing the internet (Interstate Pilot 
Using Driver for Extended Availability: 28 %; Full Automation Using Driver for 
Extended Availability: 39 %; Vehicle on Demand: 46 %; Autonomous Valet Parking: 
NA), viewing films (Interstate Pilot Using Driver for Extended Availability: 23 %; Full 
Automation Using Driver for Extended Availability: 32 %; Vehicle on Demand: 36 %; 
Autonomous Valet Parking: NA), working (Interstate Pilot Using Driver for Extended 
Availability: 22 %; Full Automation Using Driver for Extended Availability: 33 %; 
Vehicle on Demand: 36.4 %; Autonomous Valet Parking: NA) or relaxing or sleeping 
(Interstate Pilot Using Driver for Extended Availability: 31 %; Full Automation Using 
Driver for Extended Availability: 47 %; Vehicle on Demand: 54 %; Autonomous Valet 
Parking: NA) are only regarded as positive aspects of autonomous driving by a minority. 
The most important benefits of Autonomous Valet Parking are seen to be simplifying the 
search for parking spaces (80 %), the safety of the parking location (78 %), the resulting 
free time (76 %) and the cheaper parking options outside of the inner city areas (76 %). 
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6.3.3 Summary and Conclusions 


The focus of this chapter has been the interaction between humans and autonomous 
vehicles. Proceeding on the assumption that automated vehicles will for the foreseeable 
future depend upon the availability and control of the human, we first looked at the 
cognitive-psychological effects of the human-machine interaction. This was followed by 
an empirical study of the user perspective on autonomous driving through an extensive 
online survey. The study focused in particular on the attitudes, expectations and emotions 
—the mental models—toward the subject of autonomous driving. 

Based on the scholarship thus far on the psychological consequences of automation in 
different domains (e.g. aviation, production), it may be concluded that as we proceed 
towards Full Automation Using Driver for Extended Availability, designers and devel- 
opers would do well to place greater emphasis on the human at the core of their endeavors. 
Even in the partially automated systems available today, drivers display well-known 
problems such as excessive trust and reduced situation awareness. The long-term effects of 
higher degrees of automation and the associated lengthier periods of mental decoupling 
from the task on the cognitive and motor skills required by drivers are still largely 
unknown. The effects found in this regard for highly trained and experiences airplane 
pilots, however, are alarming [38]. Training and regular manual execution of automatable 
driving tasks thus seem to be an important instrument for maintaining required and desired 
skills of the driver. 

As long as the human is a part of the availability concept of automated vehicles— 
whether as a supervisor of the system or taking over the driving task—both the human and 
the machine need a suitable representation of the respective other agent. Transparent 
interfaces adapted to the mental system of the human are the prerequisite for the necessary 
situation and system awareness in interactions with the automated system. On the other 
hand, the technical system must also be able to correctly interpret the mental state of the 
driver, her intentions and behavior and dynamically represent them in a driver model. In 
adaptive and cooperative design concepts, these aspects have already been implemented in 
highly automated vehicle prototypes [44, 67]. Moreover, vehicle manufacturers and 
research institutions are currently working on potential solutions to these problems in a 
range of different projects (www.adaptive-ip.eu; www.incarin.de; www.urban-online.org). 

The survey results highlight some emerging contradictions between what is technically 
feasible and innovations that are actually desired by the public. Although a majority of 
drivers has become accustomed to handing over certain driving tasks (e.g. cruise control) 
to assistance systems, most people are highly averse to the idea of actually letting go of 
the steering wheel. The current cognitive and affective representations of the role of the 
driver are still very strongly associated with the conventional image of an active chauffeur. 
The notion of assuming the role of a passive passenger finds little acceptance. The 
conventional, manually controlled vehicle is still so strongly associated with the ideal 
image in the public mind that for the majority, completely autonomous vehicles do not 
fulfill mobility needs. The open question is whether a step-by-step, evolutionary 
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automation of vehicles can achieve the requisite changes to the mental models associated 
with role expectations in autonomous vehicles. A situation-specific transfer of driving 
tasks to the autonomous vehicle may, as the example of the high acceptance rates illus- 
trates, represent a more fruitful alternative. 

Moreover, the results of the survey offer ideas on possible strategies for the transfor- 
mation that take their orientation from the needs and emotions of potential users. The main 
argument for the introduction of autonomous vehicles in previous public debates has been 
increased road traffic safety. This perception is not shared by the general public, however. 
Rather, the participants in this study see the benefits of autonomous vehicles as stress 
reduction, convenience and environmental friendliness. At the same time, associated 
emotions such as powerlessness and fear are powerful factors that pose a major imped- 
iment to acceptance. The human thinking apparatus is not capable of objectively esti- 
mating the risk of rare events [58], so fears and concerns can lead to irrational decisions. 
From this perspective, user-centered development means taking account of existing needs 
both in terms of communication and the concrete design of the systems. 

For the potential user, the question is ultimately the added value of an autonomous 
vehicle compared to the still highly regarded manually controlled vehicle. What should be 
the focus of one’s attention if one is no longer required, or indeed able, to concern oneself 
with the control of the vehicle for safety reasons? Contrary to expectations, a majority of 
participants was not interested in the extended range of infotainment options from internet 
to television, but instead preferred to enjoy the landscape uninterrupted. Just how stable 
and valid these assertions prove to be in concrete interactions with automated vehicles will 
have to be addressed in future studies. But perhaps this need follows in the tradition of 
German romanticism and will offer a new impetus for the design of an automated, “close 
to nature” space. 
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Communication and Communication 
Problems Between Autonomous Vehicles 
and Human Drivers 


Berthold Farber 


7.1 Introduction 


Discussions of autonomous land vehicles often invoke the example of air traffic, where the 
autopilot is responsible for steering except for take-off and landing. The question arises: 
what can we learn from air traffic? What autonomously flying aircraft and autonomously 
driving vehicles have in common is that the pilot or driver bears the final responsibility. 
But, there are a number of differences between road traffic and air traffic (besides their 
type of locomotion) that make transferring the systems from one to the other impractical. 
Two key differences that are central to this article are the application of rules and the form 
of supervision. Encounters between airplanes—primarily while taxiing—are thoroughly 
governed by strict rules. In addition, there is a supervisory monitoring and guiding 
authority that gives pilots precise instructions and, in cases that might not be covered by 
tules, reaches decisions and communicates with pilots. As such, the pilot does not have 
any room for discretion or independent decision-making. The pilot’s role is purely 
implementation. Unlike air traffic, road traffic is a self-organizing, chaotic system that, 
although it is fundamentally governed by rules, includes many situations for which 
unambiguous rules cannot be determined. In those situations, section 1 of the German 
Highway Code always applies: “Participating in road traffic requires constant caution and 
mutual consideration,” and “Those who participate in traffic shall behave such that no one 
else is harmed, endangered, or even disabled or harassed more than inevitable in the 
circumstances.” Thus, even a list of rules for behavior and all conceivable situations as 
exhaustive as the Highway Code has a large “miscellaneous” category that must be 
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resolved by road users themselves in accordance with section 1 of the Highway Code. It 
follows that one of a driver’s central responsibilities in order to safely participate in road 
traffic is to assess other road users’ behavior. This assessment and prediction of other road 
users’ behavior relies on the initial assumption of more or less rule-abiding behavior on 
their part. However, another aspect of evaluating intentions involves communication 
between drivers and road users via actions and gestures. In other words, in addition to the 
“official” rules, there exists a set of informal rules that help to guide traffic. 

Anyone who has visited another country as a tourist, whether as a driver or a pedes- 
trian, has experienced for themselves how drastically informal rules, culturally specific 
modes of behavior, and communication between road users affect traffic. Human drivers 
who encounter such divergent “canons of rules” initially react with a phase of irritation. In 
the second phase, the adaptation phase, they unconsciously adapt over time to these new 
imprecise and unwritten rules. In the consolidation phase these rules seem to be obvious 
although they are not set in stone and in some cases cannot even be precisely described. 

Motorized road traffic comprises a system with very diverse players whose goal is to 
convey road users to their destinations safely, quickly, and without incident. From the 
systemic perspective, it is immediately evident that observance of informal rules, com- 
munication between road users, and predictions of others’ behavior fulfill two key 
functions: they facilitate the flow of traffic and help to compensate for errors. 


7.2 Questions 


Expressed technically, humans are multi-sensory adaptive systems. That means that they 
are capable of taking signals that might be weak or ambiguous and extrapolating the big 
picture, which they can then interpret. They are also able to adapt to changing conditions 
in order to support the two aforementioned functions, compensating for one another’s 
errors and improving the flow of traffic. Yet what happens when, alongside humans, there 
are also robotic vehicles participating in traffic that abide strictly by rules but do not 
understand informal rules or aspects of communication? How would human drivers react 
to these new road users, especially in the transition phase when robotic vehicles remain a 
minority? Are humans capable of solving difficult or seemingly unresolvable situations in 
cooperation with robotic vehicles? Finally, which characteristics or markings do robotic 
vehicles need to have at the minimum in order to participate in mixed traffic with human 
drivers without causing problems? 

This article will approach these questions from various angles. Since autonomous 
vehicles have so far primarily been investigated in view of technical performance, as in 
the Urban Challenge [1] or the Bertha Benz drive [2], and an emergency driver has always 
been present in mixed traffic to intervene if necessary (e.g. at the Stadtpilot [3]), there is 
scarcely any original literature on the questions described above. For that reason, much 
will be extrapolated from the findings of other research fields. 
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7.3 How do Road Users Communicate? 


In addition to the standard signals for expressing an intention, such as turn signals, 
emergency lights, brake lights, the horn, and headlight flashing, road users communicate 
via a number of “informal” communication channels. This kind of communication in road 
traffic is characterized by restricted comprehensibility compared to normal human com- 
munication. According to Merten [4], there are various communication options. 


Schema Formation 

In schema formation, a road user’s behavior is anticipated based on specific character- 
istics. For example, an elderly person with mobility issues behaves differently from a 
child. One expects different driving behavior from the driver of a sports car to that of the 
driver of a large sedan. Of course, these schemata are not always accurate in day-to-day 
driving. Nevertheless, they do serve as guiding principles and help to stabilize the entire 
system of traffic. 


Anticipatory Behavior 

Small actions make the direction of someone’s behavior predictable for other road users. 
For example, if a vehicle approaches the left lane (without engaging the turn signal), this 
indicates an intention to change lanes. Similarly, if a pedestrian purposefully approaches a 
crosswalk, the driver will assume that the pedestrian would like to cross the street. 


Non-verbal Communication 

Non-verbal communication plays a role among the informal communication channels, 
especially in “negotiation situations.” Non-verbal communication is indubitably the oldest 
form of communication between living beings. As far back as 1874, Charles Darwin 
discussed non-verbal communication in his book The Expression of the Emotions in Man 
and Animals [5]. The subtlety of non-verbal signals was demonstrated by an old inves- 
tigation by Pfungst [6] of Clever Hans, a horse that was able to perform “arithmetic” based 
on unconscious, minimal signals from its owner or the audience. The important finding 
was that non-verbal signals are even sent out unconsciously and are thus not always easily 
available for analysis. 


In general, non-verbal signals can be divided into three types: 


e Facial expression and eye contact 
e Gestures and body movements 
e Voice and tone of speech. 


In the case of road traffic, only facial expression/eye contact and gestures/body 
movements are relevant and will therefore be addressed here. 
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Facial expressions and eye contact 

In local traffic, eye contact both between drivers and between drivers and other road users 
(pedestrians and cyclists) plays a critical role. Pedestrians who want to cross the street 
without a crossing aid use eye contact to ensure that an approaching driver sees them. If 
the driver returns the eye contact, pedestrians assume that they have been seen and that the 
driver will act accordingly [7]. 

When a driver from a side street wants to merge onto a main street with heavier traffic, 
the merging driver also uses eye contact to make sure he or she can turn despite the short 
time gap, as the driver on the busier street will reduce speed accordingly. 

Eye contact is a two-way form of communication. In other words, a glance is either 
reciprocated or not reciprocated by the person who is glanced at. If that person looks 
away, this sends the message that he or she has “not seen” the other person and does not 
intend to accept the signal or the negotiation. The implications of the strategy for 
autonomous vehicles should be distinguished between autonomous vehicles in which the 
driver’s seat is occupied and those where it is not. 

If the driver’s seat is occupied, there are two possibilities: 


1. The “driver,” i.e. the person in the driver’s seat, is preoccupied with other activities 
inside the vehicle and eye contact does not occur. In that case, the other road user 
cannot assume that their negotiation proposal has been accepted and will act 
accordingly. 

2. The “driver” of the autonomous vehicle is looking outside and makes incidental eye 
contact with the other road user. In that case the eye contact with non-autonomous road 
user can lead to an inaccurate understanding of the situation and thus cause a conflict. 


If the driver’s seat is not occupied, the other road user does not receive any infor- 
mation, so the situation is equivalent to the “no eye contact” scenario. 


Gestures and body movements 

Gestures are a pervasive and effective method of communication between road users. 
Many signals conveyed using gestures are generally comprehensible and mostly clear. For 
instance, nodding signifies agreement with the other person’s request. Pedestrians move 
their arms up and down to request vehicles to stop, for instance in order to secure the 
scene of an accident. Moving one’s hands downwards (Fig. 7.1) signifies that the other 
person should slow down. A sweeping hand movement (Fig. 7.2) or a gesture of offering 
(Fig. 7.3) with the palm facing upward signifies “Go ahead. I cede my right-of-way.” 
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Fig. 7.1 Slow down. Image 
rights: Risser [8] 


Fig. 7.2 Sweeping hand 
movement. Image rights: Risser 


[8] 


Fig. 7.3 Gesture of offering 


7.4 Implications of Communications Options on Traffic Safety 


At first glance, informal signals such as eye contact, gestures, or anticipatory behavior 
seem less clear-cut than standardized signals such as turn signals, the horn, headlight 
flashing, etc. In fact neither is entirely clear-cut. Interestingly, the philosopher Heidegger, 
who investigates the nature of symbols in his treatise Being and Time [9], chooses cars as 
an example: “Motor cars are equipped with an adjustable red arrow whose position 
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indicates which direction the car will take, for example, at an intersection” (cit. after 
Frerichs, [10], p. 138. Perhaps this symbol was still crystal-clear and situation- 
independent in those early days of cars, but it quickly becomes apparent that symbols 
take on different meanings in different contexts. All symbols, both verbal and non-verbal, 
can only be understood in relation to their context. As Savigny [11] explains, a distinction 
must be made between the signal and the intended meaning. Headlight flashing may have 
different intended meanings depending on the situation. If a driver who has right-of-way 
slows down and flashes her headlights, it is interpreted as an offer to yield right-of-way; if 
she is accelerating or maintaining speed when she makes the same signal, it means that 
she is asserting her right-of-way. Likewise, a right-turn signal might mean “I’m turning” 
or “I’m looking for a parking space—go ahead and pass me.” 

To consider the vulnerable road users, let us take a look at the interesting example of 
cyclists. Cyclists still use signals from the early days of motorized driving to indicate their 
intended change in direction. This means that for pattern recognition outside of highway 
traffic, an automated system needs the ability to identify both cyclists’ presence and the 
signals they make. 

What are the implications for traffic safety? Initially we may assume that autonomous 
vehicles will not be familiar with the assorted context-dependent meanings of signals and 
must therefore behave very cautiously. As long as visual recognition or a pedestrian’s 
hand signals cannot be reliably perceived and interpreted based on the situation, any 
pedestrians located on a potential collision course with the vehicle must be treated as 
hazards and trigger a suitable reaction by the autonomous vehicle. 

So when autonomous vehicles identify pedestrians on the roadway, they will 
stop. What happens if the pedestrian is a police officer directing traffic? For one thing, the 
police officer must be identified as an upright obstacle that the robotic vehicle must steer 
around. Beyond that, though, the vehicle needs to interpret the police officer’s signals. If 
the police officer holds strictly to the rules, as shown in the photographs Figs. 7.4 and 7.5, 
an autonomous vehicle can learn the associated meanings. Experience has shown, how- 
ever, that police officers directing traffic or parking lot attendants assigning parking spaces 
use very dynamic gestures to speed up traffic, such as waving their arms or hands or 
making rowing motions with their arms. See Figs. 7.6, 7.7 and 7.8. Humans usually 
understand these signals from context. Alongside the ability to recognize patterns of 
gestures and postures, autonomous vehicles would need to have contextual knowledge 
allowing them to identify and evaluate gestures correctly. 

One exceptional case is the need to accommodate vehicles with special rights, such as 
police cars, fire trucks, or ambulances. These vehicles draw attention to themselves using 
auditory signals. Visual and auditory signals (such as sirens and flashing lights) obligate 
the rest of traffic to stop, cede right of way at an intersection, or move aside to create a 
rescue lane. In everyday road traffic, vehicles do not stop right away when they hear this 
type of auditory signal in the distance. Such a reaction would severely inconvenience 
traffic, especially near a hospital for instance. It is also impossible from a distance to 
precisely identify the direction the auditory signal is coming from. Likewise, the 
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Fig. 7.4 Traffic police officer: traffic flowing. Image rights: http://commons.wikimedia.org/wiki/ 
User:Video2005?uselang=en 


Fig. 7.5 Traffic police officer 
(North Korea): chest facing 
driver means “stop”. Image 
rights: https://www.flickr.com/ 
people/kansai/ 
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Fig. 7.6 Police officer in Minneapolis signals that traffic can start moving on one side of the street. 
Image rights: http://commons.wikimedia.org/wiki/User:Calebrw?uselang=en 


Fig. 7.7 Police officer in Bangkok gestures to a vehicle to turn. Image rights: http://de.wikipedia. 
org/wiki/User:Da?uselang=en 
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Fig. 7.8 Police officer 
(Sweden) gestures to vehicle to 
move forward. Image rights: 
Olle Nebendahl 


functionality to identify special vehicles from a distance and to determine the best way to 
rearrange the lanes would be difficult to design. For that reason, autonomous vehicles 
would need to stop upon all of these signals for safety reasons so as not to put traffic in 
danger. The following section will delve more deeply into the implications of the above 
on public acceptance. 


7.5 Is the Ability to Communicate a Requirement for the Other 
Road Users to Accept Autonomous Vehicles? 


In terms of public acceptance, we must once realize again the effect of informal com- 
munication in “negotiating situations.” In keeping with the aforementioned Sect. 1 of the 
Highway Code, drivers communicate in negotiating situations in order to resolve situa- 
tions that are rule-governed in principle but where blindly following the rules would 
disturb traffic considerably. 


Example 1 
If a vehicle is parking or idling in your lane, it is sometimes necessary to cross over to the 
opposite lane and, in extreme cases, even to cross a solid center line. In busy traffic, this 
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requires coordinating with the oncoming vehicles. Apart from (unauthorized) crossing of 
the solid center line, the situation can be solved without a “negotiation” if oncoming traffic 
becomes sparse enough that the opposite lane can be used without vehicles communi- 
cating. The busier the traffic, the more likely a negotiation is necessary. 


How does the driver of an oncoming vehicle signal willingness to cooperate? First of 
all, by slowing down in order to leave room for you to cross onto the opposite lane. Yet in 
most cases slowing down alone is not enough of a signal because there are many reasons 
why a vehicle might keep a larger-than-usual following distance. That is why approaching 
drivers would usually signal this kind of offer by both slowing down and flashing their 
headlights. If the autonomous vehicle did not recognize this signal, it would be seen as a 
“traffic obstacle,” which would certainly not encourage public acceptance. 


Example 2 

As shown above, autonomous vehicles will generally behave more cautiously than human 
drivers as they have a limited grasp of the context and informal signals. Yet they can also 
perform driving maneuvers that are normally not performed by a human driver. For one 
thing, they react more quickly than human drivers. Since they tend not to have a “moment 
of shock,” their reaction time is much faster. That is one reason why autonomous vehicles 
would cause fewer accidents. Furthermore, accident research has shown that many drivers 
do not make the most of their cars’ braking capabilities and, even when swerving, tend not 
to reach the physical limits based on the circle of forces. Driver assistance systems such as 
automatic emergency brakes or emergency steer assist are intended to compensate for 
these deficiencies. On that basis, not only would an autonomous vehicle act more quickly 
in an emergency situation, but it would be able to take advantage of the physical limits of 
forward and lateral acceleration. How other road users will react is largely unknown at this 
point. The following section discusses a simple approach to solving this. 


7.6 What Mental Model Will Other Road Users Apply When 
Reacting to Autonomous Vehicle’s Driving Errors? 


Closely related to the questions of interaction and negotiation discussed earlier is the issue 
of compensating for other road user’s errors. Apart from avoiding immediate collisions 
with swerving trajectories, accommodating other driver’s errors is normal in everyday 
road traffic. First let us clarify how “driving errors” is defined. From a human driver’s 
perspective, “driving errors” might include purely rule-abiding behavior that is not ideally 
adapted to the situation. 

For example, a human-driven car with right-of-way on a main road might let an 
autonomous vehicle from a side street turn first if the human-driven car wouldn’t other- 
wise be able to turn onto the side street. In other words, if the human driver yields despite 
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having right-of-way, the autonomous vehicle would need the ability to recognize that 
reliably. 

Driving errors might also result from deficiencies in the autonomous vehicle’s reper- 
toire of strategies for resolving special situations or might be caused by reaching system 
boundaries. 


Example 

An autonomous vehicle operating in “traffic jam pilot” mode enters a safe state because 
the system’s boundaries have been reached. In other words, the vehicle slows down to a 
stop. Although slowing down to a stop is common in a traffic jam, the other road users will 
be confused at the least if all other vehicles are moving and only the autonomous vehicle 
is stopped. If the maneuver occurs fairly abruptly for a reason that other drivers do not 
understand, this can pose a danger. However, we should keep in mind that road users do 
not drive without errors either in current road traffic and other drivers usually compensate 
for their errors. This raises the question of which characteristics humans will ascribe to 
autonomous vehicles. Will they be seen as less competent than human drivers or treated as 
flawless machines? 


One goal of a deployment strategy must be to disseminate a positive yet realistic 
conception of autonomous vehicles among all road users. Then, and only then, will 
autonomous vehicles play an appropriate role in the traffic system. In general, the con- 
ditions for this are in place. For example, surveys of new technologies such as robotics 
have shown that Europeans have positive attitudes towards robots [12]. Likewise, driver 
assistance systems—as precursors of highly automated and ultimately autonomous 
vehicles—already enjoy a strong reputation as useful aids and are seeing increasing 
demand from consumers [13]. 

Apart from people’s general attitudes towards technological systems, the capabilities 
and characteristics ascribed to new technological systems depend on the user’s level of 
background knowledge. People who are less well-versed technically tend to apply naive 
behavioral models that ascribe more capabilities to technological systems than they 
actually possess. Current demonstrations of autonomous vehicles in the media, largely 
conducted for marketing purposes, invite the impression that these vehicles are masters of 
all situations. This raises the expectations of autonomous vehicles so high that any driving 
errors would cause at least irritation, if not safety concerns. For that reason, in order to 
generate a realistic understanding of potential issues, it is essential to publicize autono- 
mous vehicles’ capabilities and limitations early on. 
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7.7 Cultural Differences 


A number of questions arise related to cultural differences: Are there universal rules for 
non-verbal behavior that can simply be adapted? How can cultural differences in com- 
munication and expectations be reflected in a robotic vehicle’s communicative and 
decision-making behavior? If they can, how can they be adapted? What modes of 
behavior are there in different countries? 

The best-known culturally comparative studies on non-verbal “utterances” based on 
facial expressions were produced by Ekman [14]. Across cultures, he found common 
facial expressions for the basic emotions of fear, disgust, happiness, sadness, surprise, 
anger, and contempt. 

Most of these basic emotions do appear in road traffic, but their significance for 
communication among vehicles is rather restricted. For instance, the gestures for yes and 
no are crucial in negotiation situations. In central and northern Europe as well as the US, 
nodding means “yes” and shaking one’s head means “no.” However, in countries such as 
India, Pakistan, and Bulgaria, wobbling one’s head sideways, a motion akin to the 
European and American “no” gesture, actually signifies agreement. Finally, there is an 
additional way to indicate yes and no non-verbally in countries such as Greece, Turkey, 
and southern Italy. ““Yes’ is expressed by tilting the head forward, while ‘no’ is indicated 
by tilting it back” ([15], p. 134). Beckoning gestures are another source of misunder- 
standings during interactions among road users. A “paddling gesture” [15] with the palm 
facing down is used in Japan and the Mediterranean region for beckoning. In Germany 
and the UK, the same gesture is used to mean “go away.” Despite the cultural differences 
among non-verbal signals performed with the hands, the gestures used to insult or rebuke 
other people in road traffic are largely universal, interestingly enough. Raising an index 
finger (Fig. 7.9), tapping on one’s temple (Fig. 7.10) or making a sweeping motion 
beginning at the temple (Fig. 7.11) conveys one’s contempt for the recipient. One 
exception is that forming an upright circle with one’s thumb and index finger means 
(mostly) “o.k.”in Germany, whereas in Italy it is understood as a gesture of insult (ass- 
hole) (Fig. 7.12). 

In contrast to the pan-cultural basic emotions and “gestures of frustration,” there are 
certainly cultural differences in informal communication among road users that are 
expressed in driving behavior and are currently in flux. 

It is generally agreed that southern Europeans drive both more assertively and more 
defensively than central Europeans. In southern Europe, acceleration and the horn act as 
informal signals among vehicles. A driver merges into a lane of traffic by accelerating 
rapidly into a gap (potentially while honking the horn), expecting that the other road users 
will yield. The driver does not expect any other feedback, but simply assumes that the 
intention to merge will be recognized and accepted. 

In central or northern Europe, the driver of the merging vehicle would tend to expect 
feedback in the form of eye contact at the least, if not a nod or a hand gesture. In Germany, 
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Fig. 7.9 Lifted finger. Image rights: copyright belongs to author 


Fig. 7.10 Expressing frustration. Image rights: copyright belongs to author 
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Fig. 7.11 A sweeping motion beginning at the temple to indicate bewilderment at the other 
person’s behavior. Image rights: copyright belongs to author 


at any rate, it is commonplace to insist on one’s right-of-way so it would be unusual to 
attempt to merge without obtaining the other road user’s “consent,” as that would involve 
risking a collision. 

Traffic in the United States is characterized by more steady, lane-based driving. Aside 
from the official signals, informal signals play less of a role there. 

Traffic in China is—at least so far—marked by a low level of rule-abidance and by 
communication that is difficult for foreigners to interpret. Chinese drivers are masters of 
surprise, ignoring traffic rules and honking merely as a “friendly greeting” [16]. 

Communication between cars and pedestrians is especially critical. 

Pedestrians make themselves understood by gesturing with their hands, stepping onto 
the crosswalk, or waiting there until a car stops. What are the implications of this for the 
behavior of autonomous vehicles? For one thing, autonomous vehicles will predict 
whether a pedestrian intends to cross the street based on the pedestrian’s trajectory and 
acceleration. Apart from that, there are other modes of behavior that are more ambiguous, 
such as standing at a crosswalk without intending to cross (e.g. while having a conver- 
sation) or hesitating without making a clear signal of intending to cross. In all of these 
cases, the autonomous vehicle will need to stop for safety reasons. A consequence of this 
may be “unwarranted stopping” or the danger that children or teens catch on and begin to 
force vehicles to stop at crosswalks for fun. 
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Fig. 7.12 No worries! Image rights: copyright belongs to author 


Yet the regulations and the actual behavior alike vary widely from country to country. 
For instance, Italy did not have a rule requiring cars to stop at crosswalks until recently. 
According to reports from visitors to China, it is only advisable to cross at a crosswalk 
there as part of a crowd because traffic is highly unlikely to stop for a lone pedestrian. 

While pedestrians who use hand gestures to communicate assume that their gestures 
are seen, they usually would not cross the street if an oncoming car did not slow down. 


7.8 Means of Compensation 


In the first stage, there is an easy antidote to the dilemma of robotic vehicles’ inability to 
communicate informally in “negotiation situations.” 

Clearly and visibly marking autonomous vehicles as such would announce the vehi- 
cles’ uniqueness to the other road users and make their deviant behavior more under- 
standable. This would indicate to other road users that they cannot expect the usual 
behavior and would consequently increase acceptance in the sample situations described 
above. After all, vehicles for learner drivers are identified very visibly in order to inform 
other road users and excuse behavior that might be either excessively rule-abiding or 
overly hesitant. 
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Especially in the introductory phase, several considerations support including identi- 
fying markings. If vehicles drive without a person sitting in the driver’s seat, as envisioned 
by the “valet parking” scenario, this might irritate the other road users. “Is that car moving 
autonomously or is it just driving out of control?” With identifying markings, there is no 
need to ask. Marking autonomous vehicles can also have a marketing effect that will help 
give rise to rapid adoption. For example, when ABS was introduced, there were ABS 
stickers available that read “This vehicle has ABS brakes” to indicate that the braking 
distance was shorter. Technically that is not quite correct because ABS mainly makes it 
easier to steer while braking, but from a marketing viewpoint the sticker was a great 
success. 

There are also some reasons not to give autonomous vehicles identifying markings. 
Because they must strictly adhere to the rules, due to their limited ability to negotiate 
among other things, they might also be targets for unwanted external interventions. 


A simple example: 
Pedestrians would not cross a street if a car was approaching due to uncertainty as to 
whether the car sees them or whether it will stop. In the case of an autonomous vehicle, 
pedestrians can be positive that the vehicle will stop no matter what (within physical 
limits). As a result, stopping autonomous cars could become a game for teenagers or cause 
adults to cross the street without paying attention to the flow of traffic. “It has to stop—it’s 
programmed that way.” Neither development would be good for the flow of traffic and 
this would not have a positive affect on the acceptance of autonomous vehicles. 
Whether it has an outright negative effect is hard to predict. That is highly dependent 
on how exactly autonomous vehicles are introduced. If they are seen as a positive tech- 
nological innovation and excused for having certain imperfections, a negative effect 
would be scarcely likely. On the other hand, if they are seen as an elite status symbol, 
envy will predominate and attempts to disrupt the system will be more common. 


7.9 New Forms of Communication for an Effective Exchange 
of Information from Both Psychological and Technological 
Perspectives 


Autonomous vehicles must generally be able to recognize and interpret other road users’ 
gestures and trajectories. In order to interpret them, they will need situational knowledge 
allowing them to put signals in the correct context. The “official” signals such as turn 
signals, the horn, and headlight flashing would probably suffice in most situations in order 
to convey information to other vehicles or road users. 

Kent Larsen’s research group at MIT proposed an interesting approach for commu- 
nication between autonomous vehicles and pedestrians [17]. A prototype with a variety of 
sensors but only remotely resembling an actual car was fitted with a number of devices. 
Swiveling, blinking LEDs designed to look like an eye turn towards a pedestrian, sig- 
naling “I’ve seen you.” 
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Additionally, directional speakers point towards pedestrians and tell them that it is 
okay to cross the street. 

If any pedestrians are identified, color-coded LEDs in the wheels could change from 
green to yellow to red in order to acknowledge pedestrians or warn them (Fig. 7.13). 

Another signal that autonomous vehicles can use to communicate with others is “ex- 
plicit driving.” 

For example, if another vehicle would like to merge and the autonomous vehicle wants 
to cooperate, the autonomous vehicle should visibly slow down in order to accentuate the 
gap and assure the other driver that it is safe to merge. 

Communication and informal rules are in constant flux. To illustrate this point with a 
verbal example, take the expression that something “sucks.” Not too long ago, this word 
was understood as a direct sexual reference, provoking understandable consternation 
when young people began generalizing it. Similarly, the non-verbal signal “thumbs up” 
recently spread to countries where it was unfamiliar due to its iconic use in social media. 
From one angle, that means that autonomous vehicles will need to periodically learn new 
signals of non-verbal behavior, for instance by regularly updating their visual “vocabu- 
lary” along with associated meanings. Yet another effect can also be anticipated. The 
increased presence in road traffic of autonomous vehicles practicing a distinct, particularly 
rule-based set of behavior could also encourage other road users to adopt such behavior. 
This would make traffic more standardized, but not necessarily more efficient. Flexible 
cooperation between road users becomes more important when the traffic is busier. The 
distances narrow between vehicles, the complexity increases, and more informal signals 
are exchanged. 


Fig. 7.13 AEVITA: Autonomous Electric Vehicle Interaction Testing Array. Image rights: 
Nicholas Pennycooke, Changing places group, MIT Media Lab (copyright belongs to author) 
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Car-to-car communication could provide another technological solution. This would 
require all road users—not only autonomous vehicles—to be fitted with the corresponding 
technology. Car-to-car communication has undergone years of research and there have 
already been a number of demonstrations, some of them on large test sites such as simTD 
[20]. The proliferation of vehicle-to-vehicle (V2V) or vehicle-to-x (V2X, vehicle to 
infrastructure) technology could significantly facilitate solving the communication issues 
between autonomous vehicles and human drivers. 

Frost & Sullivan [21] project that by the year 2030, 40 % of vehicles will be equipped 
with V2V or V2X technology due to the major advantages these technologies offer users, 
including reducing traffic jams and enhancing safety. The rapid spread of this technology, 
initially with a different focus in mind, could thus mitigate communication problems 
between autonomous vehicles and those driven by humans. 

Yet even then there will still be some situations that autonomous vehicles cannot solve, 
either because the other road users do not have the necessary communication devices or 
because the situation cannot be resolved through communication alone. If the autonomous 
vehicle operates without a driver to take over driving on short notice (although not 
immediately), a remote driver or guidance system would have to step in. 


7.10 Conclusions 


Because vehicle-to-vehicle communication options are currently very limited and unre- 
liable, a wide variety of glances, actions, and action sequences are used to communicate 
with unprotected road users. Depending on the circumstances and the state of mind of the 
people involved, interpersonal negotiations can have varying levels of intensity. The rules 
applied in these cases are highly culturally specific. In particular, the expectations placed 
on the other person vary widely from culture to culture, so it would not be possible to 
compile universal rules for robotic vehicles. Another problem arises merely due to the fact 
that the vehicle’s driver, the robot, is unrecognizable. This is evident for driverless cars, at 
any rate. If a person is sitting in the driver’s seat of the autonomous vehicle, any com- 
munication would likely be misdirected at the presumed human driver. Mixed traffic 
including cyclists and other vehicle types would be difficult to implement without the 
ability to recognize other road users’ glances and gestures. This is especially true in 
low-speed settings. As the speed increases, this form of communication plays a less 
significant role for a variety of reasons: 


e It is not 100 % explicit. 

e It requires feedback from the other person, which would take too long. 

e At high speed there is a limited ability to assess the other road user’s reaction. There is 
not enough time to evaluate another driver’s gaze, for instance. 


What requirements does this create for ensuring functionality based on communication 
with other road users? 
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As such, autonomous vehicles must initially behave as if there were no informal 
communication, in other words, abiding completely by the rules. In the event of an 
unresolvable situation, either a human driver must take over, or in the absence of one, a 
centralized authority would need to intervene. Traffic management would be organized 
similarly to air traffic, in which air traffic control coordinates all aircrafts’ movements both 
in the sky and on the tarmac. Instead of a pilot executing air traffic control’s instructions, 
the robotic vehicle would receive instructions about how to maneuver and independently 
ensure the vehicle’s stability as it carried them out. It remains unclear how an autonomous 
vehicle would recognize that the situation cannot be resolved or how the traffic control 
authority would be informed of the relevant details. 
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Part Il 
Mobility 


Barbara Lenz and Eva Fraedrich 


Foreword 


Will autonomous driving alter people’s mobility? Will we be mobile in different ways in 
future? Quite simply, what will be the pathway to future mobility? And what do transport 
and urban planners need to think about when planning tomorrow’s mobility, with its 
autonomous vehicles? These types of questions from the “Mobility” section are aimed at 
discussing initial informed reflections on an everyday world where autonomous driving is 
an integral part of the transport system. The authors of the seven subsequent chapters 
examine the issues posing particular challenges in realizing “autonomous mobility.” 

Establishing a framework for such (mobility) trends is a task that politicians are only 
gradually beginning to turn towards. In their chapter Autonomous Driving—Political, 
Legal, Social, and Sustainability Dimensions, Miranda Schreurs and Sibyl Steuwer show 
which initiatives have been encouraged on the part of policymakers not only in Germany, 
but also in the EU and USA. They make clear how objectives and interests at both 
industrial and policy level guide the approach of political bodies, and how these are 
primarily aimed at pursuing long-term objectives. The authors also advocate providing the 
debate on autonomous driving with a broad setting, allowing for the technology’s social 
relevance to be addressed alongside technical and legal issues. 

In their article New Mobility Concepts and Autonomous Driving: The Potential for 
Change, Barbara Lenz and Eva Fraedrich look at the question of how new mobility 
concepts such as carsharing, and also old ones like public transport, could change by 
integrating autonomous vehicles into them. They identify how these systems may be made 
more flexible in potentially very far-reaching ways, and they also pick out starting points 
for individualizing public transportation. They conclude that autonomous vehicles offer 
considerable potential, initially only gradually becoming visible, for transforming the 
transport system and increasing the public system’s attractiveness. At the same time, 
however, they point out that trends in the new systems’ costs and profitability will require 
measuring. 
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The article Deployment Scenarios for Vehicles with Higher-Order Automation by Sven 
Beiker examines potential paths to the practical introduction of autonomous vehicles. The 
author distinguishes between three scenarios on the path to autonomous vehicles: (1) an 
evolutionary scenario, (2) a revolutionary scenario, and (3) a transformative scenario, and 
then looks at their impact on the transport system, their demands in terms of technical 
developments, their regulatory requirements, and their significance for corporate strate- 
gies. He concludes that the scenarios named are currently still completely independent of 
one another, and it is possible that the path to autonomous driving will initially proceed in 
different usage areas that will only “merge” step-by-step. 

What will it actually mean for our cities to have autonomous vehicles on their roads? In 
his paper Autonomous Driving and Urban Structure, Dirk Heinrichs takes a look at what 
impact automated road traffic could have on cities and urban structure. He also examines 
current scenarios for cities of the future with regard to ideas developed for transport, 
particularly those assuming fully automated road traffic. He lays out the essential positive 
effects as well as the negative ones. In each case, argues Heinrichs, it is the task of 
integrated urban and transport planning to confront in good time the challenges of 
autonomous driving, and above all to consider the interplay between long-term and daily 
mobility decisions. 

In order to be able to evaluate mobility and transport trends in terms of their impact, 
and of how controllable they are, transport and urban planners require quantitative 
models. One important element in this field is so-called demand modeling. This is able to 
map, for example, how changes in car usage—in this case, to be driven instead of to drive 
oneself—affect people’s mobility. At present, however, it is still difficult to develop such 
models, as empirical values on people’s transport behavior in the face of automated 
driving are not yet available. In her paper Autonomous Vehicles and Autonomous Driving 
from a Demand-Modeling Perspective, Rita Cyganski discusses how autonomous driving 
may be integrated into demand models. Based on a survey, she further shows that simply 
assuming the advantages of being driven is, for the moment at least, not realistic, and 
therefore also not an appropriate starting point for demand modeling. 

One essential influence on transport demand stems not least from the vehicles with 
which demand is served. In their chapter on the Effects of Autonomous Driving on the 
Vehicle Concept, Hermann Winner and Walther Wachenfeld describe what opportunities 
there are for changes to the vehicle concept in the areas of bodywork, drive system, 
chassis, interior, and the human-machine interface. The authors then outline how the 
vehicle itself and its usability could change as a result of all this, and they suspect that 
automation will not be a driver of revolution in the vehicle concept. They do, however, see 
considerable scope for vehicles to further diversify in purpose specific ways. Not least, 
this may lead to them being used in new ways—perhaps even as rolling living rooms, 
workspaces or bedrooms. 

It is possible that autonomous vehicles will not only be used privately, but also as part 
of passenger transport systems. These systems might not only operate on the roads 
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autonomously, but also provide automated services. With his chapter Implementation of 
an Automated Mobility-on-Demand System, Sven Beiker firstly lays out the basic research 
questions that need answering here, and then introduces the current implementation of 
such a system on the campus of Stanford University in California. The chapter thus 
provides a vivid example of an actual deployment of a road vehicle in a public space, 
albeit a controlled one. 


Autonomous Driving—Political, Legal, 
Social, and Sustainability Dimensions 


Miranda A. Schreurs and Sibyl D. Steuwer 


8.1 Introduction 


Autonomous driving (self-driving) vehicles, once just a science fiction dream, are a 
growing reality. Although not commercially available, rapid advancements in technology 
are creating a situation where technological development needs are moving beyond the 
regulatory environment. Technological developments have put pressure on governments 
to make regulatory changes permitting on-road testing of autonomous vehicles. Nevada 
became the first government worldwide to provide licenses for the testing and operation of 
autonomous vehicles in the state albeit under strict conditions. The Nevada Department of 
Motor Vehicles notes that “when autonomous vehicles are eventually made available for 
public use, motorists will be required to obtain a special driver license endorsement...” 
[8]. Other states have followed Nevada’s lead. New regulations in the United States have 
provoked the question of whether regulatory changes are necessary in Europe as well. 
This chapter examines the emerging competition among automobile manufacturers related 
to the development and deployment of autonomous vehicles and their political and reg- 
ulatory implications. Special attention is paid to the role of industrial stakeholders and 
political actors in relation to the development, uptake, and regulation of autonomous 
vehicle technologies. This is done from a comparative perspective considering develop- 
ments in the United States, the European Union, the United Kingdom, Germany, Sweden, 
and Japan. The different framings of autonomous vehicle technologies and their potential 
contributions are also considered. 
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8.2 Autonomous Driving from an Innovation Policy Perspective 


Increasing vehicle automation can be understood as an innovation process that may 
eventually lead to autonomous or semi-autonomous vehicles. Innovations can be classified 
according to the kind of innovation (e.g. product, process, organizational), the phases of 
innovation (invention, innovation, diffusion) or the magnitude of innovation (ranging 
from incremental to radical). A variety of influencing factors shape innovation processes. 
These include actors and actor networks, institutional frameworks, and technological 
developments both inside the innovation system and external to it. There may be 
co-evolutionary development of (technological) innovations and influencing factors [35]. 
Political intervention is one factor that can influence innovation processes and is our focus 
below. 

Automated technologies have been incorporated into cars for decades, including 
anti-lock brakes, rear view alarm systems, lane departure warning systems, and adaptive 
cruise control. Information and communication technologies are likely to make possible 
the rapid deployment of some automated technologies (as is already the case with auto- 
mated braking systems). Automated driving technologies could improve emergency 
response, enhance public transport systems, and optimize intermodal passenger transport. 

Autonomous vehicle technology is now rapidly developing as autonomous driving 
vehicles are tested on the road. Various future development paths are possible as indicated 
by the use cases described in the chapters by Wachenfeld et al. (Chap. 2) (see also Beiker 
in this book Chap. 14). Autonomous vehicle technology development paths range from 
incremental (e.g. automatic braking systems and transmission systems) to larger (auto- 
mated crash avoidance safety systems and autonomous valet parking) to revolutionary 
changes to existing systems (fully autonomous vehicles in regular traffic) (for a definition 
and nomenclature see e.g. [25, 44]). Depending on the state of a technology and the 
degree to which it has been implemented, there are different policy implications and 
regulatory intervention needs. 

Different technological and use paths place different demands on the policy system. 
Incremental technological changes can usually be addressed with relatively minor changes 
to existing regulatory frameworks. More radical technological changes, such as the fully 
autonomous vehicle, will require deeper regulatory interventions as well as societal 
awareness raising and acceptance. The information and communication technologies 
(ICT) used in autonomous vehicles could also raise various questions related to data 
protection and storage although this will depend very much on the kind of technologies 
employed (Chap. 24). 

Certainly one of the changes visible in relation to the emergence of autonomous 
vehicle technology is the emergence of new stakeholders. The technologies involved have 
widened the field of actors engaged in transport policies and led to the formation of new 
political coalitions. The ICT industries are important stakeholders in autonomous vehicle 
technologies and policies. Auto manufacturers and other players (like Google) are both in 
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competition in the development of prototypes and in cooperation with each other in an 
effort to achieve a more favorable regulatory environment for the testing of autonomous 
vehicle technology. 

The commercialization of autonomous vehicles is envisioned in the coming years by 
some manufacturers although there is considerable uncertainty as to when and if the 
technology will be made commercially available any time soon. Conditions for com- 
mercialization may also vary significantly country to country depending on road traffic 
conditions. While there are many questions as to whether commercialization is realistic in 
the near future, expert communities are urging regulators to prepare. In some jurisdictions 
(especially in the United States) early preparatory steps for potential deeper regulatory 
changes are being taken. 

The speed and quality of advancements in autonomous driving technologies will 
impact demands for political intervention and steering. Many political interventions are 
driven by technological advancements. In the case of incremental technology develop- 
ment, there may be a parallel process of incremental regulatory changes, licensing deci- 
sions, or increase or decrease in financial or other political support schemes. 

Incremental technological changes can be researched from the perspective of systems 
innovation theory, where innovations are understood as a result of multilateral interaction 
processes among firms, industries, organizations, and institutional frameworks [13-15]. In 
the case of more revolutionary technological developments which result in more dis- 
ruptive changes to the status quo, politicians may be forced to make rapid and major 
regulatory decisions with little preparatory or learning time and with few existing expe- 
riences to draw upon. 

In some cases, political actors may decide to try to accelerate the development of 
certain technologies and their large scale application. We have seen examples of 
policy-driven development with, for example, nuclear and renewable energies. In these 
cases, governments set incentives to support the development of these technologies, e.g. 
with research and development funding, support schemes, loans, the provision of 
infrastructure, and the taking over of liability risks and in the case of some countries, later 
made decisions to phase-out the use of a particular technology. There are also various 
examples in the transport sector, where state actors aimed at paving the way for certain 
technological choices. Apart from providing road infrastructure and thereby supporting 
individual automotive transport systems, e-mobility is a recent example of an attempt by 
policy-makers to help boost the implementation of a particular technology on a larger 
scale [7]. 

Policy makers do not typically like to intervene in the workings of market economies 
but at times may feel pressured to do so. As Edquist formulates it “[t]here must be a 
“problem’—which is not automatically solved by market forces and capitalist actors—for 
public intervention to be considered” [14]. 

Different factors may be behind a decision to support new technologies or techno- 
logical applications. Policy makers may choose to promote a technology’s development in 
order to support the competitiveness of a domestic industry, in response to 
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problem-pressures (e.g. safety or environmental factors), to experiment with new tech- 
nological possibilities, or in reaction to international developments. As Edler and his 
colleagues put it: “Public innovation policy aims to strengthen the competitiveness of the 
economy or of selected sectors, in order to increase social welfare through knowledge 
creation and economic success” [12]. Numerous studies illustrate the importance of 
political intervention especially in the field of environmental policy innovation (see e.g. 
[30-32]). 

There are several ways political actors can support the development and diffusion of 
new technologies. They may encourage and support the development of expert networks, 
finance research and development, create demand for a certain technology (e.g. by setting 
up support schemes or mandating government purchasing of a technology), and, by 
providing basic infrastructure (for a summary of approaches see [35]). Research support 
has been relevant in the development of autonomous vehicle technologies as well. States 
that are lagging behind in the technology are now scrambling to catch up. Since inno- 
vations go through various phases (see e.g. [26, 36]), governmental interventions may also 
be limited to particular innovation stages of a technology. 


8.3 Visions of Autonomous Driving in Europe 


Visions of the future can both influence and reflect regulatory debates and their public 
perception. Visions for autonomous driving are being shaped by various stakeholders who 
have their own interests in advancing particular framings. When particular framings of a 
technology take hold, they have the potential to direct future R&D trajectories and other 
societal and political actions. As we will see below, autonomous vehicle technologies are 
increasingly being viewed as an important component of future transport systems. Their 
development is being linked to concerns about industrial competitiveness, sustainable 
development, resource efficiency, safety, and assistance for the elderly and others who 
might otherwise not be able to drive a car. At the same time, there are some voices of 
concern that there could be a loss of control through robotization of automobiles. Here we 
consider how autonomous driving is discussed at the European level before turning further 
below to discussions in other economies. 

To understand how autonomous driving vehicles are being discussed at the European 
level, we looked at strategy documents, European-funded research projects, and important 
networks related to autonomous driving. The analysis shows something of a mismatch 
between the interests of specific industrial actors in a rapid commercialization of auton- 
omous driving technologies with broader European visions and objectives in the transport 
area in which autonomous driving technologies play some role, but little attention is given 
to autonomous vehicle technologies. Autonomous driving technologies are not widely 
discussed in European strategic documents although some research projects are being 
funded. This could be important since the extent of attention given to a subject and the 
visions associated with it may determine whether or not political support is lent to a 
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technology’s development. With little explicit attention given to autonomous driving 
vehicles at the European level, little political action can be expected unless there are either 
sudden technological innovation shocks or stronger political lobbying by stakeholders. 


8.3.1 European Strategy Documents 


Autonomous driving technologies have received little attention to date in European 
Commission strategic documents, including roadmaps, green papers, and white papers. To 
the extent autonomous vehicle technologies are discussed it is often in the context of 
broader EU debates on European competitiveness, innovation, climate protection, energy 
security, employment, and education (the EU 2020 strategy) [17]. 

Guided by the general framework objectives of the EU 2020 strategy, the following 
documents were analyzed: “Roadmap to a Single European Transport Area - Towards a 
competitive and resource efficient transport system” [18], “Research and innovation for 
Europe’s future mobility. Developing a European transport-technology strategy” [19], the 
“CARS 2020: Action Plan for a competitive and sustainable automotive industry in 
Europe” [20], and the “Directive on Intelligent Transport Systems” [24]. These strategic 
documents cover issues linked to autonomous driving: mobility, infrastructure, digital- 
ization, and general European discourses related to innovation and climate protection. The 
documents differ in their degree of specificity. 

These documents shed light on which actors are taking up autonomous vehicle 
developments and give an impression of how far reaching the debate on autonomous 
driving currently is in Europe. They also give a picture of how autonomous driving 
technology is being framed and which other societal, technological, and political issues it 
is being linked to. Finally—and maybe most importantly—these documents hint at the 
opportunities for and obstacles to the wider implementation of autonomous vehicle 
technologies at the European level. 


8.3.1.1 Competitiveness and Innovation 
The European Union has as one of its goals strengthening the competitiveness of Euro- 
pean industry and technological leadership including in important sectors like transport. 
The European Union’s transport roadmap stresses that “innovation is essential” to 
maintaining European competitiveness. Three areas of innovation that are stressed are: 
“efficiency through new engines, material, and design”, “cleaner energy use”, and “safer 
and more secure operations through information and communication systems” [18]. 
The communication document from the European Commission to the Parliament and 
the Council with the title “Research and innovation for Europe’s future mobility. 
Developing a European transport-technology strategy” [19] can be seen as the starting 
point for the development of a strategic transport-technology plan. At its visionary core is 
the expected change towards high value-added, innovative transport technologies. The 
transport industry of the future is expected to have to deal with highly complex mobility 
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systems and to achieve this with a much lower carbon content. New materials, new 
production processes and new technology partners as well as “a stronger cross-fertilisation 
between the transport modes” are seen as crucial elements of this industry transition. The 
communication further stresses the expectation that the transport sector, the energy sector 
and information and communication technologies will be increasingly intertwined. 

With regard to the automotive industry, strengthening competitiveness is central to 
European policy-makers. This is reflected by the CARS 2020 Action Plan, which was 
developed by DG ENTR (Directorate-general for Enterprise and Industry). The Com- 
petitive Automotive Regulatory System for the 21st century (CARS 21), the antecessor to 
CARS 2020, is concerned with overcoming the economic crisis in general and the crisis of 
the European automotive industry in particular. It sets a vision of: “An automotive 
industry that is leading in technology, in coordinated action with the fuel supplier 
industry, producing vehicles which are attractive to EU consumers, clean in terms of 
regulated pollutants, more fuel-efficient, safe, quiet and connected” [20]. 


8.3.1.2 Efficiency and Sustainability 

At the European level, innovation is often linked to the development of an energy and 
resource-efficient and sustainable transport system. The transport roadmap spells out “A 
vision for a competitive and sustainable transport system”. The document highlights the 
dual goal of increasing transport and mobility within the Union while reducing green- 
house gas emissions by 60 % until 2050. It further links EU 2020 and its flagship 
initiative on resource efficiency to transport policy. This translates into a transport system 
that “uses less and cleaner energy, better exploit a modern infrastructure and reduce its 
negative impact on the environment and key natural assets like water, land and ecosys- 
tems” [18]. The document preparing the transport-technology strategy repeatedly stresses 
the EU’s vision to strengthen competitiveness by decarbonizing the transport system and 
accordingly calls for research in green technologies, material substitutions, and ICT in 
order to optimize intermodal and public transport and thereby enhance efficiency [19]. 
And also the CARS 2020 action plan establishes a strong link between competitiveness 
and clean and green vehicles [20]. 


8.3.1.3 Harmonization and Coordination 
Realizing a single European market is at the heart of all European strategic documents 
related to transportation. This is a factor in the strong push for greater harmonization and 
coordination of national policies. The transport roadmap highlights the importance the EU 
Commission attaches to harmonization; here it is argued that “a situation where (for 
example) one Member State opted exclusively for electric cars and another only for 
biofuels would destroy the concept of free travel across Europe.” It also illustrates that the 
EU Commission aims at influencing technology development. 

Also in the CARS 2020 action plan the fragmentation of vehicle regulation among EU 
Member States is considered problematic. The European Commission has called for more 
coordination and standardization [20]. In the CARS 21 process, Europe’s role in 


8 Autonomous Driving—Political, Legal, ... 155 


standardization has been highlighted. European Commission Vice-President Neelie Kroes 
“underlined the business opportunities created by making vehicles digital and connected, 
which requires public support for funding and standardisation” [4]. CARS 2020 mentions 
the deployment of Intelligent Transport Systems (ITS) with reference to the automatic 
emergency call system, eCall as a particular organizational challenge which demands 
strong coordination [20]. 


8.3.1.4 Safety 

The “vision zero” which refers to the goal of eliminating traffic fatalities and injuries by 
2050 is a key selling point for the industry. Safety is also addressed in the transport 
roadmap, although it receives considerably less attention compared to other issues, such as 
competitiveness, sustainability, resource-efficiency, or, innovation. 

The “vision zero” is mentioned as the ninth of ten goals of the transport roadmap. In 
line with this goal, the EU aims at halving road casualties by 2020. The EU is to be a 
world leader in safety and security of transport in all modes of transport [18]. Annex I 
spells out how to approach that goal and mentions—besides training and education— 
technological solutions such as “driver assistance systems, (smart) speed limiters, seat-belt 
reminders, eCall, cooperative systems and vehicle-infrastructure interfaces.” These can be 
seen as steps towards a general increase in automation and employment of information 
and communication technologies. 

While the Directive on Intelligent Transport Systems puts comparatively high priority 
on an increase in safety through the application of information and communication 
technology, it does not explicitly speak of autonomous driving [24]. 


8.3.1.5 Summary 

The document, “Research and innovation for Europe’s future mobility. Developing a 
European transport-technology strategy” [19] is where one might expect autonomous 
driving to be discussed as the communication addresses research, innovation, and mobility 
issues. Yet, while the term ‘smart’ occurs repeatedly in the text, neither ‘autonomous’ or 
‘driverless vehicles’ are mentioned. ‘Intelligent’ and ‘automated’ are mentioned only once 
in the context of transport infrastructure: “Modern infrastructure will increasingly incor- 
porate new components which make it smart (intelligent, ICT-enabled and automated), 
green (new light and recyclable materials) and intermodal (automated terminals, hubs, and 
equipment). It will integrate the provision of alternative, low carbon fuels and innovative 
management and operation systems” [19]. 

Also with regard to research and innovation, autonomous driving is not discussed in 
the transport-technology strategy document although it could be argued that smart 
mobility is related to autonomous driving. Many of the visions described in the strategic 
document can be seen as being linked to autonomous vehicles, such as the interdepen- 
dence between information and communication technologies and the transport system. 
Yet the main focus is on green technologies, material substitution and ICT and the 
optimization of intermodal transport. 
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Similarly, autonomous driving is not explicitly mentioned in the transport 
roadmap. Rather, intelligent transport systems, new communication services, and 
improved traffic management and information systems are seen as future opportunities to 
optimize traffic flow and reduce congestion and it is in this context that there are calls for 
further research and innovation. Links are made to multimodality and optimization of the 
use of infrastructure. Increased automation is not discussed centrally in relation to the 
modernization of the automotive industry in Europe. It is not even mentioned as an 
explicit topic in the CARS 2020 action plan. 

The Directive on Intelligent Transport Systems, supported by DG Transport, targets steps 
to be taken towards the application of ITS and thus could be argued to touch upon aspects of 
autonomous driving, but does not explicitly mention the term or similar terms [24]. 

In summary, it can be said that while developments related to autonomous driving are 
mentioned in major strategic and vision documents, autonomous vehicles or autonomous 
driving are as such not firmly embraced by European bureaucrats or politicians. 


8.3.2 Research Related to Autonomous Driving (EU) 


Somewhat more attention to autonomous vehicle technologies is being paid in 
European-funded research projects. There are various research projects funded by EU 
institutions that could impact autonomous driving. eCall is an initiative to bring rapid 
assistance to motorists involved in accidents. The Galileo project is a civilian global 
satellite-based navigation system. TAXISAT, is a related global navigation satellite sys- 
tem being developed for taxis. The SARTRE project, which is funded under the European 
Union’s Framework 7 program, aims at advancing platooning (convoying to make more 
efficient use of road space). The project HAVE-it follows a long-term vision of autono- 
mous driving and aims at high levels of automation. The purpose of the project is to 
“develop, validate and demonstrate important intermediate steps towards highly auto- 
mated driving” such as advanced driver assistance systems. The research project, 
“SMART- New services enabled by the connected car”, focused on the implication, 
benefits, and services of connected cars. The project’s final report concluded that the 
connected car may make better use of infrastructure and will increase safety as well as fuel 
efficiency. The EU project “Citymobil— Advanced Transport for the Urban Environment” 
looked at automated public transport systems and some showcases (e.g. La Rochelle, 
Heathrow) with the aim of bringing the implementation of these public transport systems 
in cities one step further. An example of a joint public-private R&D initiative supported 
by various directorates-general (RTD—Research and Innovation, CNECT—Communi- 
cations Networks, Content and Technology, ENER—Energy, ENV—Environment, 
ENTR—Enterprise and Industry) in the vehicle area is the European Green Cars Initiative 
launched in 2009 and with a priority on the development of efficient, safe, and envi- 
ronmentally friendly mobility, especially electro-mobility. Another important project is 
AdaptIVe, a successor to InteractI Ve. Started in January 2014 and funded by the European 
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Union’s Framework 7 Program, this consortium of 29 partners aims to demonstrate the 
potentials for automated driving in complex traffic environments while addressing some 
legal issues related to levels 1 to 4 of the SAE classification system. 

Currently, the European Union is supporting research on autonomous driving within its 
framework research support scheme, “Horizon 2020”. There are several entry points for 
research on autonomous vehicles under the Horizon 2020 work program on leadership in 
enabling and industrial technologies in the section on Information and Communication 
Technologies [22]. Research for the transport sector is funded via the work program’s 
Chap. 11 on smart, green and integrated transport. Here, autonomous driving is explicitly 
mentioned: “Automated and progressively autonomous driving applications in road 
transport, actively interacting with their intelligent environment could provide an answer 
to the EU objective of reconciling growing mobility needs with more efficient transport 
operations, lower environmental impacts and increased road safety” [21]. Apart from 
technical aspects including research on Advanced Driver Assistance Services, other 
aspects are supported such as behavioral aspects of driving (users’ responses to tech- 
nology and on-board infrastructure, conditions of attention/loss of attention, etc.), ethical 
and gender issues as well as liability and standardization questions. The aim is to enhance 
the technology’s robustness and effectiveness in real-life situations. 

In sum, research funded by the EU addresses various aspects of vehicle automation, the 
linking of information and communication systems to enhance efficiency, and research 
into autonomous vehicle technologies. There are growing signs of interest in the legal and 
societal implications of various automation levels and efforts to develop common defi- 
nitions of vehicle automation levels. In the future, there will be need for more research on 
legal and societal questions tied to the greater use of automation in the transport sector. 


8.3.3 Actors and Arenas for Autonomous Driving in the EU 


At the European level, different Directorates General (DG) are involved with questions 
addressing autonomous driving, with DG Connect being somewhat more engaged than for 
example, DG Mobility and Transport (MOVE) or DG Enterprise and Industry (ENTR). In 
general, the EU Commission’s interests in the transport area are more related to 
strengthening competitiveness throughout the whole Union including in remote areas (by 
e.g. supporting basic infrastructure development) and combating climate change (i.e. 
e-mobility, urban development that supports public transport, bicycles, etc.) and not so 
much on implementing a vision of wide-spread use of autonomous driving vehicles. 

DG Connect supports research in the field of automated mobility. It mainly addresses 
the research on intelligent transport systems (ITS) and highlights the role of ICT for ITS 
and mobility for it helps to reduce greenhouse gas emissions, increases energy efficiency 
in the transport sector, and enhances safety and mobility for people and goods in general. 
ICT is, however, mostly connected to the provision of real time traffic information and not 
explicitly to autonomous road vehicles. 
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Information on autonomous driving is generally best assessed from DG Connect. 
While various aspects and projects are listed on their website, DG Connect forwards the 
reader to the iMobility Forum when looking for ‘Automated Driving’. iMobility is one of 
the two main platforms on the European level that addresses vehicle automation. Via the 
iMobility Forum, the Commission is in contact with stakeholders. The platform is chaired 
by DG Connect and co-chaired by ERTICO-ITS Europe as well as the European Auto- 
mobile Manufacturers Association (ACEA) and the European Association with tolled 
motorways, bridges and tunnels (ASECAP). Within iMobility, there is a working group 
on vehicle road automation. DG Connect partly finances this network. The iMobility 
Forum is linked to the ERTICO platform on intelligent transport systems in Europe. It was 
founded as a joint initiative by the European Commission, national transport ministries as 
well as industry representatives and aims to be a networking platform to spur exchange 
between actors and stakeholders related to all kinds of aspects of intelligent transport 
systems. It gives an overview about various research projects and activities in European 
Member States on ITS—and accordingly, automated vehicles [16]. 

In addition, the European Union provides a platform for debating visions of the future: 
FUTURIUM, part of the Digital Agenda of Europe. Here several articles about autono- 
mous driving can be found. 

To summarize, autonomous driving is not strategically anchored in European 
policy-making. The overarching discourses and objectives in the European transport 
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sector can be subsumed under the headlines “competitiveness”, “sustainability”, “effi- 
ciency”, “low-carbon” and, to a lesser degree, “safety”. While autonomous driving can 
arguably contribute to any of these overarching objectives, stakeholders have not yet made 
much effort to make these links. The actors most actively addressing autonomous driving 
at the EU level deal with communication technologies, smart mobility, and intelligent 
transport systems (DG Connect including links to the EU’s vision for the Digital Europe). 
The automotive industry is mainly represented by its association. Individual companies do 
not appear very active on this issue at the EU-level. Autonomous driving is still in the 
realm of research rather than implementation and there exists no delineable vision for a 
future where autonomous vehicles play a major role. The use cases addressed in this book 
do not play a role at the European level. In addition, there is a lack of integration of the 
topic into existing visions on transport and mobility. The needs for regulation and further 
research and development are being discussed in working groups both at the European 
and the German national levels, although autonomous driving is not high on the political 
agenda in either case. While the European Commission’s administration is (co-) funding 
some of these initiatives, it has not taken a lead on the regulatory front; rather it is mostly 
active in supporting research and development. This is similar to the case in Germany. 
The issue of autonomous driving is on the radar screen of the German transport ministry 
and major associations but is only now slowly beginning to gain somewhat more atten- 
tion. As is discussed further below, one relatively important new development is the 
reform of the United Nations Convention on Traffic Safety of 1968 that has been pushed 
by European automakers concerned about losing ground to international competitors. 
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Next on their agenda is likely to be enabling legislation at the national level for testing 
purposes. 


8.4 National and International Legislative and Political 
Developments 


There are some differences in national discourses and support strategies for autonomous 
vehicles in major automobile producing markets and in the European Union. Below we 
consider developments in the United States, Japan, the European Union, the United 
Kingdom, Sweden and Germany. A common characteristic of these countries and the EU 
is that they lack national regulations for autonomous vehicles. It has been with state-level 
regulations in the United States and special permits in the case of European countries that 
test driving of self-driving cars has begun on public roads [33]. 


8.4.1 Regulatory Changes to the United Nations Convention 
on Road Traffic (Vienna Convention) 


Reacting to developments in the United States, at the European level debates about the 
need for modifying the United Nations Convention on Road Traffic (the Vienna Con- 
vention) which had been on-going for about a decade, intensified. Article 8, paragraph 5, 
of the 1968 convention states: “Every driver shall at all times be able to control his vehicle 
or to guide his animals” [5]. Before Google pushed the debate forward, there was con- 
siderable disagreement among experts as to how much of an obstacle the Vienna Con- 
vention was. Google’s release of its Self-Driving Car tipped the scale in the direction of 
regulatory change. As reported by Euractiv in the summer of 2013: “The EU is currently 
slightly lagging behind the U.S. Autonomous driving is forging ahead in the US where 
steps are currently being taken to advance the technology by states adopting laws allowing 
for public road testing. However, Europe continues to lag behind the US with restrictive 
legislation that could, for the foreseeable future, effectively prevent the introduction of 
more advanced autonomous driving systems”. The report notes that “while the technology 
is ready, appropriate infrastructures and legal framework are still missing” [34]. In May 
2014, the governments of Germany, Italy, France, Belgium, and Austria jointly proposed 
an amendment that was agreed to by the U.N. Working Party on Road Traffic Safety. The 
amendment would allow self-driving technologies as long as the system “can be over- 
ridden or switched off by the driver” [40]. If agreed upon by the parties to the convention, 
this could ease conditions for research and development of autonomous vehicles in many 
countries. For a more critical discussion see also Sect. 8.4.6. 
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8.4.2 USA 


The United States is the most advanced nation in terms of introducing autonomous driving 
vehicles into its transport system. Legislation on autonomous driving has been passed in 
California, Michigan, Nevada, Florida, and the District of Columbia. In another six states 
—Arizona, Colorado, New Hampshire, Oklahoma, Oregon, Texas—the legislative 
attempts failed or are pending. There are another dozen of states with ongoing regulatory 
initiatives. Some common features of their regulation regard the definitions of autono- 
mous driving and autonomous vehicles employed and the conditions for obtaining 
operation and testing permission. Liability issues are also beginning to gain attention. 
California has set a 2015 deadline for the establishment of liability rules [48]. The leg- 
islation enacted in the United States is in many ways with an eye towards the testing of 
autonomous driving vehicles as it is currently very restrictive regarding their use. At this 
stage neither the U.S. government nor the automotive industries want to take large risks in 
relation to a technology that is still in an early development stage and that must still prove 
its reliability and safety. The same could be said for the other countries looked at here. 

Regulatory initiatives in the United States were a direct response to Google’s push for 
legal clarification regarding the status of autonomous vehicles. Google, an active devel- 
oper of self-driving soft-ware and technology, has lobbied state by state for the legislation 
enabling the operation of self-driving vehicles. 

Various U.S. politicians have strongly spoken up for the technology. Governors and 
other state politicians have on various occasions praised autonomous vehicles in public 
and claimed their leadership relative to other states by being frontrunners in passing 
supportive legislation. 

Nevada Governor Brian Sandoval in early summer 2011 upon the passage of his state’s 
first law on autonomous driving vehicles stated: “Nevada is the first state in the country 
that is going to be (adopting) regulations for this vehicle (...) I think it is important for 
Nevada to be first on this. This is going to be part of the future and Nevada has always 
been a very progressive state” [49]. In the Florida Senate, Republican Jeff Brandes 
sponsored an autonomous driving bill stating, “this legislation is about vision and lead- 
ership for the 21st Century world and forges a path for future innovative economic 
opportunities for Floridians” [42]. In September, when signing autonomous driving into 
law, Californian Governor Jerry Brown pointed out that he sees autonomous vehicles as 
“another example of how California’s technological leadership is turning today’s science 
fiction into tomorrow’s reality. (...) This law will allow California’s pioneering engineers 
to safely test and implement this amazing new technology” [2]. Noting that the state was 
slipping behind competitors, Michigan’s Governor Rick Snyder urged action. In his state 
of the state speech in January 2013 the governor lamented: “They [California, Nevada and 
Florida] are ahead of us, and aren’t we the automotive capital of the world?” [6]. These 
examples give a clear impression of how politicians are starting to see autonomous vehicle 
technology and why they are promoting autonomous driving. For the leaders of these 
pioneering states, autonomous driving is seen as a sign of being on the technological 
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cutting edge. The technology’s developers stress the safety benefits expected to come with 
the implementation of the technology, the increased comfort it will provide for elderly 
people, and the reduction in traffic congestion it should bring about. 

Google has been an important entrepreneur that has stimulated both technological and 
regulatory developments. Google is a new and non-traditional player in transport, a sector 
which until now has been dominated by the automotive industry. With its retrofitting of 
automobiles with robotic software, the IT-company has challenged the automotive 
industry to innovate in new directions (Chap. 10). As noted above it has also put regu- 
lators under pressure to take action. Indeed, regulations have had to catch up with the 
technological innovations. Google’s actions have also pushed self-driving technologies 
onto the international agenda. It has opened up new research agendas and challenged 
policy makers and legal experts to consider the technological and social meanings of this 
rapidly developing new technology. In the European Union as well as internationally, it is 
also leading to discussions about the need for early harmonization of standards so as to 
prevent the institutionalization of incompatible standards in different world regions, e.g. 
via United Nations Economic Commission for Europe (UNECE) regulations and vehicle 
type approvals that make sure that a vehicle design is conform to technical requirements. 
Beyond these issues, the role of ICT in the automotive industry of the future and very 
importantly, data protection concerns, will need societal debates and decisions. 

In May 2013, the National Highway Traffic Safety Administration (NHTSA) estab- 
lished an official classification scheme for vehicles which range from level 0 where the 
driver is in complete control of the vehicle at all times to level 4 where the vehicle 
performs all safety-critical functions and monitors roadway conditions for the entire trip 
and could include unoccupied cars. The intermediary levels make increasing use of 
autonomous vehicle technologies. The NHTSA also issued recommendations to aid states 
as they make regulatory decisions regarding vehicles with new technological capacities 
[1]. There are other classification schemes that have developed as well. In particular the 
comprehensive SAE Standard J3016. It distinguishes between six categories with levels 0 
(no automation), 1 (driver assistance) and 2 (partial automation) subsumed under the 
headline “human driver monitors the driving environment” and 3 (conditional automa- 
tion), 4 (high automation) and 5 (full automation) labeled as “automated driving systems” 
[44] (see also Sect. 8.4.6 for the BASt classification scheme). 


8.4.3 Japan 


Influenced by Google’s lobbying at the state level in the United States, Japan has begun to 
exhibit more interest in autonomous vehicles. Japan is renowned both for its robotic 
technologies and its low-carbon vehicle technologies. In 2013, Nissan received approval 
from the Japanese authorities to test its self-driving car, the Nissan Leaf. The Leaf is the 
first car that combines an electric motor with an advanced driver assistance system [3]. 
Kanagawa Governor Yuji Kuroiwa and Nissan Vice Chairman Toshiyuki Shiga tested the 
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car on the Sagawa Expressway near Yokohama [38]. Prime Minister Shinzo Abe also has 
tested several “self-driving cars” produced by Japanese manufacturers Toyota, Honda, and 
Nissan and has claimed that he senses “that the Japanese technology is the world’s best” 
[39]. “In particular, in tough driving conditions such as tight curves and lane changing 
using autonomous driving, I think our Japanese technologies are among the world’s best” 
[37]. The competition to be a leader in the field is clearly heating up and politicians are 
lending their visibility and weight to support this emerging technology. 


8.4.4 United Kingdom 


The situation of the United Kingdom is emblematic of the situation in many European 
states. There is growing concern that national automobile developers are being hampered 
by regulatory restrictions and lack of a clear political strategy for autonomous vehicles. 
A September 2013 advise of the British Houses of Parliament, Parliamentary Office of 
Science and Technology notes, “There is no explicit legislation which governs autono- 
mous vehicles on UK roads”. The advice further laments: “At present there is no pub- 
lished strategy for the adoption of autonomous vehicles in the UK” [29]. As is the case 
with several other European member states, steps to improve the possibilities for testing 
are being taken. The British Ministry of Science and Universities has designated £6 
million for research and technology into autonomous vehicle technologies and the 
Department for Transport is permitting trials on public roads. 


8.4.5 Sweden 


Sweden is an early pioneer of self-driving technology. The Swedish Government signed a 
memorandum of understanding with Volvo to allow ordinary people to use self-driving 
cars. The project involves the Swedish Transport Administration, Lindholmen Science 
Park and the City of Gothenburg. It is the first project that aims at testing autonomous 
vehicles on a larger scale with regular citizens. The project which started in 2014 aims at 
putting 100 autonomous vehicles onto a 50 km long road in Gothenburg by 2017/2018. It 
also sets the year 2020 as a timeline for when the first autonomous cars will be available 
for general usage [23]. 

The collaboration between the Swedish government and Volvo in this project suggests 
that in Sweden there is political recognition of the potential importance of this new 
technology. Swedish public officials highlight not only the safety dimensions of the new 
technology but also other sustainability factors. Ms. Catharina Elmsäter-Svärd, the 
infrastructure minister listed the many challenges to be tackled in the years to come that 
would be addressed by autonomous vehicles. These included environment, climate 
change, space, and traffic safety. In Europe, there appears to be a stronger linking of broad 
sustainability themes to driver-less cars than is the case in the United States [47]. 
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Claes Tingvall from the Swedish Transport Administration explained why cooperation 
between the government and Volvo makes sense. Such cooperation can help address 
legislative questions regarding the new technology early on. At the same time, the societal 
benefits from the new technology can be incorporated into policy more generally: “We 
can make traffic as a whole safer, smoother, less polluting, but also try to build infras- 
tructure in a quite different way”. Minister Elmsater-Svard noted: “This project is very 
unique and the expectation from the Swedish government is still to be in the lead when it 
comes to road safety. We know that livability, environment issues and also road safety is 
so close together in the project.” Noteworthy, is that the inscription on the Volvo 
self-driving car states: “Drive Me. Self-driving cars for sustainable mobility” [47]. 


8.4.6 Germany 


In Germany, autonomous driving vehicles are in the testing phase. For public demon- 
stration purposes, the former Minister for Research and Development, Annette Schavan 
tested the autonomous driving vehicle, “MadeInGermany”, developed at Freie Universitat 
Berlin. Autonomous—Autonomie- und Fahrerassistenzsysteme für Pkw und Lkw’”—was 
supported with 2.2 Million Euros by the Research Ministry. In an interview, Minister 
Schavan mentioned the necessity for further innovation of the technology as it could 
enhance the mobility of elderly and handicapped people [41]. Apart from AutoNOMOS, 
various other research projects in Germany helped to advance an increase in automation 
towards autonomous driving, including the Technical University of Braunschweig’s 
H-Mode and TU Darmstadt’s’ Conduct-by Wire projects. 

The research ministry, which is interested in supporting innovative technologies and 
advancing technological niches, has set incentives to promote research on autonomous 
driving. The ministry’s high-tech mobility strategy stresses links among energy policy, 
e-mobility and intelligent logistics. It further stresses the role of ICT applications in the 
automotive industry, although it does not focus explicitly on autonomous driving [11]. 
But not only has the research ministry funded research on autonomous driving. Currently, 
there are more projects under way which are funded by the Federal Ministry for Economic 
Affairs and Energy, one of which is the project Afas. It is set up to develop a driverless 
vehicle to protect construction sites on highways. 

The Federal Highway Research Institute has—similarly to the NHTSA—elaborated a 
nomenclature to facilitate the legal assessment of different degrees of automation. The 
nomenclature distinguishes “driver only” and “assisted” systems from systems with 
“partial automation” (the system takes over lateral and longitudinal control in certain sit- 
uations), “high automation” (the driver does not need to continuously monitor the system) 
and “full automation” (the system fully takes over lateral and longitudinal control) [25]. 
This categorization is widely accepted by German experts, bureaucrats, and political 
stakeholders. 
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The German automotive industry has begun pushing for change. Partnering with 
Nokia, Mercedes-Benz responded to the Google challenge in August 2013 with the S 500 
Intelligent Drive Autonomous Car long-distance test drive. Following the historic path 
travelled by Bertha Benz in 1888 in the world’s first long-distance road trip, the S 500 
Intelligent Drive vehicle successfully drove on its own between Mannheim and Pforzheim 
(with a driver behind the wheel as a back-up). Audi, BMW, and auto-suppliers Bosch and 
Continental Automotive Systems are working on autonomous and semi-autonomous 
vehicle technologies as well [40]. 

The German government has not, however, responded with new regulatory initiatives 
or an explicit strategy to push the implementation of autonomous driving. Rather, gov- 
ernmental actors are focused on other technology options that are rather conform to 
European discourses of sustainable mobility. These are linked to the broader over-arching 
policy towards a low-carbon energy transformation. E-mobility, for example, is not only 
backed by a strategic governmental document but also repeatedly affirmed in speeches by 
high-level politicians, including the chancellor [9, 10]. 

The VDA is one of the technology’s strongest proponents lobbying for regulatory 
change. It is one of the few actors that has expressed a clear vision for autonomous driving 
in its publications. The VDA has organized conferences centered on vehicle automation, 
the connected car and autonomous driving The VDA envisions autonomous driving to be 
a wide-spread reality in the future. The association has illustrated concrete steps to be 
taken on the way towards a self-driving future, such as Lane Changing Support, improved 
human-machine-interface, and longitudinal guiding assistance [45]. In addition, supply 
companies have an interest in pushing a higher degree of automation in vehicles and, 
consequently, autonomous driving [7]. 

The main national arena addressing autonomous driving is a round table initiated and 
run by the Transport Ministry. On the working level, the participants are trying to insti- 
tutionalize a stakeholder dialogue as a first step in getting the issue more strongly on the 
German political agenda. The approximately 45 round table members meet twice a year. 
They consist of representatives of the German Association of Automotive Industry 
(Verband der Automobilindustrie, VDA), representatives of automotive manufacturers, 
the Ministry of Transport, the Federal Highway Research Institute (BASt), the Federal 
Motor Transport Agency (KBA), the Ministry of Justice, the Ministry of Economy and 
Energy, representatives of science and research (e.g. Fraunhofer Institute, German 
Aerospace Center (DLR), universities) and associations (such as the Association of 
International Motor Vehicle Manufacturers (Verband der internationalen Kraft- 
fahrzeughersteller, VDIK), the German Insurance Association (Gesamtverband der 
Deutschen Versicherungswirtschaft, GDV), the German Automobile Club (Allgemeiner 
Deutscher Automobilclub, ADAC), and the Association of the Technical Control Boards 
(Verband der TUVs). Three working groups have been established and meet four times a 
year. The working groups are concerned with legal questions, issues tied to drivers and 
vehicles including type approval, and research. 
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The focus on type approval—the procedure whereby an EU Member State certifies that 
a type of vehicle, system, component or separate technical unit satisfies the relevant 
administrative provisions and technical requirements [23]—in the second working group 
on driver and vehicle, shows that the round table aims at dealing with many issues at a 
technical and rather low regulatory level (compared to more general legal questions that 
would require changes in regulatory law or in the road traffic act). Many aspects of 
automation do not touch upon regulated aspects and would be generally allowed since 
they are not defined under the UNECE system. Higher level legal aspects would be in the 
realm of the Ministry of Justice but are currently not dealt with. 

The topics discussed at the round table address highly automatized vehicles but tend 
not to address fully automated driving technologies. 

The round table talks are to some degree strategic in that they aim at putting or keeping 
the topic on the political agenda. It is not so much about visions but about attempts to 
show progress in practice. However, the whole process is neither very transparent, nor 
very visible—meeting discussions are not documented for the general public and societal 
stakeholders are not widely included. There is also little exchange with European plat- 
forms on autonomous driving. 

In relation to the Vienna Convention, different views regarding the importance of its 
amendment have been expressed in Germany. The amendment was welcomed by Thomas 
Weber, head of group research at Daimler and head of development at Mercedes-Benz 
who was quoted as saying: “Today I am only allowed to take my hands off the wheel to a 
limited extent. Thankfully the Vienna Convention on Road Traffic has been changed” 
[40]. Other German experts did not see the convention as so much of a hindrance in 
relation at least in regard to the highly, but not fully-automated vehicles. By definition, in 
highly automated vehicles, a driver would always be expected to be present and able to 
take over control and monitor traffic as expected by current legislation. These experts 
considered amendments to public regulatory law to be more important and this has yet to 
occur [25, 43]. In a personal interview, Dr. Christoph Hecht from the German Automotive 
Club, ADAC, representing the consumer perspective explained that a customer has no 
incentive to buy a highly automated vehicle unless they are allowed to make use of it. 


85 Analysis 


Autonomous driving is only slowly emerging as a concept known to all but a small 
community of experts. It is not deeply anchored in European mobility discourses, 
strategies, or outlooks. Yet there is some linking of autonomous driving technologies to 
other strategic concerns, including competitiveness of the automotive industry, sustainable 
mobility, safety, and the elderly. The framing of autonomous driving varies by national 
context, reflecting the dominant concerns of different regions. In the United States, where 
there are over 30,000 traffic deaths each year, safety issues are brought to the fore. In 
Japan, which has been faced by a long economic slump, competitiveness is a top priority. 
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In Sweden, autonomous driving is of being linked to sustainable mobility. In Germany, it 
is high-end automobiles that are being fitted with autonomous driving technology, sug- 
gesting the importance being at the technological cutting edge in the luxury automobile 
market. As autonomous vehicle technologies advance, debates in Europe and abroad may 
shift, but for the timing being it appears that the commercialization and wide-spread use of 
fully automated driving vehicles remains a distant vision. 

Innovations in autonomous driving technologies are being presented as important for 
technological leadership in the automobile sector across all of the jurisdictions examined 
here even if autonomous vehicles are not yet seen as commercially viable. 

In the United States, regulatory competition is emerging among states eager to be seen 
as frontrunners in systems that could make traffic safer and traffic flows smoother. 
State-level actors are boasting their regulatory initiatives to show their state’s techno- 
logical leadership. Leadership in realizing ‘science fiction’ visions may be important for 
long-term competitiveness. This could either be seen as a kind of “Delaware effect”, with 
states competing to attract industries to their region with the provision of favorable reg- 
ulatory environments, or conversely, a “California effect,” where states compete with each 
other by establishing the more advanced regulatory standards to promote technological 
innovation and competitive advantage within their own states [46]. 

In Japan, politicians are sending the message to consumers (both domestic and over- 
seas) that autonomous driving technologies can be linked to Japanese technological 
strengths in robotics, electro-mobility and energy efficiency, to produce next generation 
automobiles. The Swedish government is among the most ambitious in its aim to com- 
mercialize autonomous driving vehicles by 2020 and set “sustainable mobility” into 
motion. 

The German government has done little to initiate broader discussions about autono- 
mous driving. While the Transport Ministry has organized a stakeholder platform at the 
national level, it has not tried to stimulate wider public debates at the German national 
level or as part of official consultations at the European level. The main push for greater 
discussion and strategizing has come from stakeholders. Volvo, for example, has been 
quite active at the EU level as has the German automobile association (VDA). Also 
component suppliers such as Continental and ICT companies have lobbied for more 
support. 

Although by no means definitive, the research conducted here suggests some other 
interesting patterns that deserve further attention as well as some soft and preliminary 
conclusions. 

First, the kind of regulatory competition seen in the United States, may be spreading to 
the international level as countries vie with each other for technological leadership in a 
newly emerging field. Autonomous driving is not only about the automotive industry but 
about many other industrial branches that will profit from a higher degree of automation 
such as component suppliers. This is why there is a growing interest in promoting 
locational advantages and why political commitments are starting to be made in some 
countries to support certain development paths. 
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Second, smaller automobile companies (e.g. Volvo, Nissan) and non-traditional players 
(e.g. Google) moved earlier with autonomous vehicle technologies to gain public and 
political attention compared with the bigger, more established automotive manufacturers 
(including German manufacturers). One might read into this that given that autonomous 
driving technologies are still at early stages of development, larger companies have been 
weary about taking reputational risks with still unproven technologies. Smaller companies 
may be more willing to take such risks since they are dependent on leadership advantage. 
Geels argues that incumbent firms’ interest in radical and transformative change is gen- 
erally not very high since incumbents have typically sunk investments in existing tech- 
nologies, skills, and people. He further points to the characteristics of more radical 
changes being more risky and leading to changes that may not match existing compe- 
tencies [27]. 

Third, autonomous vehicles are portrayed as highly innovative and demonstrative of a 
nation’s technological (and economical) leadership capabilities by stakeholders, yet 
political leaders have not played much of a role in trying to promote autonomous vehicle 
technology in public. Fully automated vehicle technology is in an early development 
stage. How it fits into dominant strategic visions for mobility or how realistic commer- 
cialization of the technology is, is still not clear which may explain why only limited 
political actions have been taken. 

Fourth, the Zero-Accident-Vision has been an important message for developers of 
autonomous vehicles and component suppliers. The vision appears to play a larger role in 
the United States where there are higher fatality rates than is the case in Europe or Japan 
although in all countries considered, greater use of remote sensing and other technologies 
is seen as a means of improving traffic safety. 

Fifth, links to efficiency and environmental protection are found in all countries, but are 
especially strong in Japan and Europe. And within Europe, Sweden is pursuing this image 
quite aggressively. 

Sixth, there are many unsolved questions with regard to accountability, data protection, 
the legal framework as well as social and ethical considerations. These issues are only 
slowly beginning to be debated. The possible impacts of autonomous driving on mobility 
behaviours and human-machine interactions as well as data protection and acceptance 
aspects will need to be studied and addressed. Indeed, nowhere has there been much 
political attention paid to the societal implications of greater use of autonomous vehicle 
technologies even though there are many non-technical aspects that must be considered 
(Chap. 29). These include the development of appropriate regulations covering techno- 
logical, safety, and liability standards as well as rules of the road for autonomous vehicles. 
There remain also many open questions with regard to public regulatory law, licensing 
law and liability law in the countries considered (Chap. 25). 

Seventh, perhaps reflective of the fact that autonomous vehicles are still only in early 
pilot testing phases, few efforts have been made to develop future mobility scenarios in 
which autonomous driven vehicles play a central role (Chap. 11). In Europe, the 
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driverless-car vision has not been embedded in an overall strategy for realizing sustainable 
mobility. 

Finally, where the most governmental activity can be seen is in providing support for 
research and development of autonomous vehicle technologies. States that are lagging 
behind technologically are scrambling to catch up by supporting more research and 
development. There are still critical technical issues that need further developing before a 
wide-scale application of autonomous driving can be considered and this provides 
opportunities for new entrants. There are also uncertainties regarding which technologies 
may win out in the long run. 


8.6 Conclusion 


Since there are already numerous technological solutions being implemented that are 
linked to various societal goals (e.g. e-mobility, intermodal solutions, strengthening public 
transport), autonomous driving will have to be debated in the context of these (competing 
or complementary) technological paths. Discussions about future mobility possibilities 
and the role that could be played by autonomous or partially or highly automated vehicles 
should be more inclusive. It should not be restricted to an arena primarily concerned with 
technical and legal questions such as the round table in Germany. Other stakeholders such 
as non-governmental organizations or think tanks could be integrated into existing 
structures (stakeholder platforms, legal processes, etc.), but new arenas could also be 
created. In parallel, advisory bodies could be set up to assess not only technological 
advancements and needs, but also social, environmental, and regulatory implications of 
greater use of autonomous driving technologies. 
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New Mobility Concepts and Autonomous 
Driving: The Potential for Change 


Barbara Lenz and Eva Fraedrich 


9.1 Introduction 


Transport is an expression for the satisfaction of mobility needs with different means of 
transportation—for everyday travel, people walk, cycle, drive or take public transport. 
There are two main groups here: people with a distinct preference for using private 
vehicles, and people who prefer so-called “ecomobility’—the combination of public 
transport with walking and cycling [1]. In addition, a group has been emerging for some 
years of “multimodal” users, who no longer restrict themselves to a particular mode or 
mix of modes, but rather exhibit a wide range of modal use in their personal repertoire 
[1, 2]. This gradual transformation in behavior has coincided with the development of new 
mobility concepts that, firstly, involve a further development of conventional carsharing 
[3], but also supplement established ridesharing with new forms. New concepts already in 
operation include flexible carsharing fleets, such as those of Car2Go, DriveNow and 
Multicity, that are available as mobility services in cities in Germany, and across Europe 
and the USA. In parallel to this has been the emergence of so-called peer-to-peer services, 
where private owners make their vehicle available to a community of members via an 
internet platform. On online platforms such as Mitfahrzentrale and Zimride, private 
individuals offer rides on routes and at times when they themselves will travel in any case. 
Additionally, more and more services such as Uber and Lyft are currently starting up, 
where the distinction between (semi-)professional individual transportation, comparable to 
taxi services, and “standard” ridesharing is not always so clear-cut. The new forms of car 
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and ridesharing services have primarily arisen in the major cities and metropolitan areas of 
industrialized countries. 

What is new, and also special, about these mobility concepts is the high degree of 
flexibility they offer users. Flexible carsharing vehicles are available at any time and for 
any duration, with no pre-planning. The new ridesharing services are similarly flexible, 
although in this respect they resemble conventional taxis. One essential prerequisite for 
the emergence of all new mobility concepts is the possibilities that information and 
communications technology now offer for networking vehicles, users, and operators. This 
is what makes fundamentally fast and easy access to vehicles or services via the internet or 
smartphone apps possible in the first place. Access, in the sense of the physical distance 
between the user’s location and the vehicle, is still a hurdle, however, particularly in areas 
where vehicle density is not very high. 

With the introduction of autonomous vehicles, it seems possible to appreciably extend 
and diversify existing mobility concepts. Accessing and egressing a vehicle is changing, 
in that the user no longer goes to the vehicle, but the vehicle comes to the user. Vehicles 
themselves are becoming usable for a wider section of the population, e.g. those with 
impaired mobility. New forms of public transport are possible, also in the sense of further 
blurring the boundaries between private and public transport. 

This article aims to introduce these options and the expectations accompanying them, 
concentrating on carsharing. First, we shall outline the current state of provision and usage 
of so-called “new mobility concepts,” at the heart of which is carsharing. The main section 
discusses the opportunities and challenges resulting from the introduction of autono- 
mously driving vehicles into carsharing fleets. There are currently a series of indications 
that spontaneity and flexibility could be particularly significant factors in the use of new 
mobility concepts (see [11, 13]). Precisely this increased spontaneity could be the starting 
point for new mobility concepts with autonomous vehicles. The operators of flexible 
carsharing fleets are already thinking on such lines [4]. 


9.2 Carsharing: “Core Application” of New Mobility Concepts 


There has been carsharing in Germany and numerous other countries since about the 
1980s. Carsharing is here understood as the operation of a fleet of cars that is available 
either in station-based or point-to-point systems. Every holder of a valid driver’s license 
can register as a member of a carsharing organization—usually upon payment of a reg- 
istration fee—and thus acquire access to the vehicles. The basic variations in carsharing 
result from the spatial and temporal conditions for vehicle access, and also from the 
business models; Fig. 9.1 summarizes the various concepts’ main features. 
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Fig. 9.1 Scheme for car use in the tension between private and commercial use 


9.2.1 Station-Based Carsharing 


The standard form of carsharing is station-based carsharing, where vehicles are furnished 
at “collection points.” The user must pick up the vehicle there and bring it back to it. The 
length of use is agreed in advance. In contrast to traditional rental cars, station-based 
carsharing vehicles may be rented by the hour, as well as by the day, although hourly 
rental is now also increasingly available among rental companies. Users pay a basic 
annual fee and vehicle use is charged according to duration and mileage. This varies 
according to organization or provider, and can also be adjusted according to demand, 
depending on time of day and day of the week. There is no restricted area of operation. 
When these services began, reserving vehicles largely took place over the phone; book- 
ings are now also made on provider websites or mobile device applications. 

At the time of writing (2014), station-based carsharing is available at approximately 
3900 stations in 380 cities and municipalities in Germany [5, 6]. This also includes a 
whole series of medium and small towns. There is already very good coverage in German 
cities of over 100,000 inhabitants, while only 5 % of municipalities with less than 50,000 
population have carsharing services available [7]. The 3900 stations are served by a fleet 
of 7700 vehicles from some 150 carsharing providers. The German market leader is 
Deutsche Bahn (Flinkster), which owns around 55 % of the station-based fleet [8, 9]. The 
worldwide leader in standard carsharing, with a fleet of about 10,000 vehicles in the USA, 
Canada, the UK, Spain, and Austria, is the American company Zipcar, founded in 2000 
and currently owned by the Avis Budget Group (as of August 2014). 
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9.2.2 Flexible (One-Way) Carsharing 


New forms of carsharing have emerged in recent years. Especially in Germany, but also in 
the UK and USA, a new type of commercial carsharing, known as “flexible,” has 
appeared. Its flexibility mainly consists in not needing to previously arrange the time and 
duration of use with the provider, and not having to pick the vehicle up, or bring it back, to 
a specified location. Instead, the user collects the vehicle from wherever he comes across 
it, and leaves it at any random position within an operating area defined by the provider. 
The user acquires information on what vehicles are available at a particular location on the 
internet or via a smartphone app. In principle, a vehicle can also be rented “in passing,” 
i.e. a user rents a parked, non-reserved vehicle on the street. It is also necessary to be 
registered with the fleet operator to use a vehicle, which is initiated via a chip card or, 
most recently, directly via the user’s smartphone. 

The worldwide leading corporation in flexible carsharing is Car2Go, with more than 
10,000 vehicles in 27 cities in Europe and North America (as of August 2014). In 
Germany, flexible carsharing providers have a combined fleet of around 6250 vehicles [5]. 
These, however, are in service almost exclusively in large cities of more than 500,000 
inhabitants such as Berlin, Hamburg or Munich. Furthermore, the operating areas do not 
cover the entire territories of these cities, but are limited to a part of them, mainly the city 
center, its bordering neighborhoods and “island zones” with high usage frequency. Apart 
from a one-time registration fee, there are no further regular charges. Vehicle usage is 
charged on a time-dependent scale, mostly per minute. As with station-based carsharing, 
fuel costs are included in the fare. Moreover, parking fees are also included, which are 
normally agreed on a flat-rate basis between the provider and the municipality. 

Flexible carsharing started as a pilot project of Car2Go, a Daimler Group company, in 
2009 in Ulm (Baden-Wiirttemberg, Germany). Other relevant operators by now include 
DriveNow, active since 2011 and a venture by BMW and Sixt Autovermietung; and also 
Multicity, a joint venture between Citroen and Deutsche Bahn that operates vehicles 
powered purely by batteries. At the same time, new operators are increasingly attempting 
to break into the market: Quicar, for example, which belongs to the Volkswagen group, or 
Spotcar, which launched in Berlin in June 2014. 


9.2.3 Peer-to-Peer Carsharing 


Peer-to-peer carsharing—hiring out private cars between private individuals—is only in 
the first stages of evolving into the third form of carsharing systems using online com- 
munication platforms. Precise user numbers are not yet available. In this system, bookings 
are processed via an online platform. There are no picked up and dropped off stations. 
Vehicles are instead picked up and drop off at specially agreed locations. A glance at a 
web platform such as www.autonetzer.de is enough to show that this form of carsharing is 
in no way limited to large cities, but can also be found in smaller cities and municipalities. 


9 New Mobility Concepts and Autonomous Driving ... 177 


This would appear to confirm Hampshire and Gaites’ assumption [10, p. 14] that 
peer-to-peer carsharing is scalable in form—in contrast, for now at least, to commercial 
carsharing. The fleet composition is also markedly dynamic, as persons who are prepared 
to offer their car do not appear to do so constantly, as a basic mode of behavior. The 
findings of a study in Berlin instead suggest that car owners only make their vehicles 
available at certain times, for example when they themselves use them at low levels due to 
personal circumstances [11]. 


9.3 Users and Use of the New Mobility Concepts 


The objectives associated with carsharing vary depending on the perspective of the parties 
involved. The political context in Germany largely involves setting up the necessary 
framework conditions to implement carsharing on the local level. The essential motives 
here are to reduce private car traffic volumes (as carsharing users also increase the share of 
public transport in their modal split over the duration of their carsharing use), to con- 
comitantly lower CO, and air pollution emissions, and to shrinking the amount of land 
used by non-moving car traffic (see Chap. 19). Commercial operators, such as car man- 
ufacturers (generally in cooperation with car rental companies) or transport service pro- 
viders such as Deutsche Bahn, use carsharing to pursue product-related strategies. 
Extending their provision with an (additional) mobility service, or offering their own 
brand’s attractive vehicles, thus generating brand allegiance, are two examples. Other 
motives for operating a carsharing fleet include decidedly ecological aims, which have 
essentially driven carsharing’s emergence, and which are adhered to by interest groups 
and associations [12]. 


9.3.1 Users and Usage Conditions 


Carsharing users in 2014 form a specific group in view of both composition and mobility 
behavior. They are clearly above the population average in various respects: proportion of 
under-40s, proportion of men, proportion of people with high levels of formal education 
(high-school diploma, higher education graduate) and household income. This deviation 
from the population mean is more highly pronounced for flexible carsharing than 
station-based [3]. Both types of carsharing are combined with a highly above-average use 
of public transportation. Studies on carsharing use from 2014 show, for example, that 
52 % of Flinkster customers in Berlin and 44 % of Munich Flinkster customers have a 
public transport season ticket. A high proportion of DriveNow and Car2Go users are 
likewise season-ticket holders: 43 and 38 % of DriveNow customers in Berlin and 
Munich respectively [13, p. 12]; for Car2Go this figure stands at 40 % in Stuttgart and 
50 % in Cologne [15, p. 13]. Nationally, the average for core-city dwellers is 33 % ([1], 
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authors’ own analysis; in Germany, official figures count all urban municipalities with 
more than 100,000 inhabitants in the category of “core city”). 

Good public transport or the possession of an own car currently appear to be essential 
preconditions for carsharing use. Only in this way is one-way usage possible in the 
flexible carsharing variant. If the user had to organize those trips that are complementary 
to his carsharing trip by himself, this would most likely be highly inconvenient. The 
attractiveness of a system that allows for individual routes would clearly fall. In the case 
of station-based carsharing, public transport is also often the main form of transport for 
users. In many cases, carsharing vehicles represent a second, supplementary car, used as 
needed, in car-owning households [16]. In order to meet this need, and in the sense of 
creating a symbiosis, there has been long-standing cooperation between station-based 
carsharing and public transport providers, now being replicated with the new flexible 
carsharing services [17]. 


9.3.2 The Carsharer—the “New Citizen” in a Sharing Economy? 


Under the slogan “using not owning,” carsharing is frequently called on as an example for 
the transformation from an ownership economy to a “sharing economy” [18, 19]. This 
perhaps results from carsharing’s particular visibility, as an act that takes place in public 
view. Behind this, however, possibly lies some astonishment at objects that are still seen 
as status symbols being used by several random people in a rental system. 

In fact, carsharing is one in a long line of trends where “goods” that were never 
previously rentable are “shared” on a hire basis: owner occupied apartments, allotment 
gardens, cars. Economists account for whether a good can be loaned (or not) by the 
difference between the transaction costs accrued and the revenue that can be generated by 
the rental. If there is a positive difference, the rental is justified, and the greater the 
difference, the greater the interest in renting it out [20]. Renting something out only makes 
sense for individuals, however, when they have a product they do not use to full capacity 
—hence the renting out of cars when not in use, apartments when the owner or main 
tenant is on holiday, and parking spaces in front of the house during the day, when the 
owner is at work. 

Looking at the effects of shared use essentially stems—at least in Germany—from the 
debate surrounding the sustainable use of resources [21-23]. At aggregate level—te- 
gional, national or even supra-national—sharing thus appears to be a possibility for saving 
resources. On the individual level, in contrast, sharing does not mean consuming less, but 
rather the opportunity of maintaining or even increasing consumption levels. Carsharing, 
where members have at their disposal a wide choice of vehicles, even a selection of 
vehicle types, can in fact be viewed as an example of this. It offers a range of consumer 
goods, in this case in the form of vehicles, that outstrips what the majority of private 
households could own themselves. On the aggregate level, less vehicles are needed (the 
German Bundesverband Carsharing (BCS) quotes figures of 42 people sharing one 
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station-based vehicle and 70 persons sharing a flexible one; [5]); on the individual level, 
high mobility levels are nevertheless assured. 

In its first years, carsharing was often associated with attitudes where car driving is not 
something done purely for its own sake. Car users with this attitude thus took no pleasure 
in driving (see [21, p. 92]). Carsharing usage was instead motivated by a desire to counter 
the environmental degradation for which users held the growing motorization of private 
households responsible [12]. It is possible that this has fundamentally changed. For 
instance, carsharing, in both station-based and flexible forms, has evolved into a com- 
mercial product. Moreover, studies on the use of flexible carsharing have found that 
aspects such as “attention received, appreciation experienced, fun and enthusiasm” are 
absolutely essential motivations (see [24, p. 21]: approval ratings of the corresponding 
statements between 38 and 86 %). Carsharing vehicles and their use here take on the 
emotional and psychosocial functions that were previously ascribed to cars only in the 
form of ownership [22]. Bardhi and Eckhardt view “sharing” (termed by the authors more 
accurately as “access-based consumption’) as a defining characteristic of a “liquid soci- 
ety,” in which fixed reference systems, such as those arising from property, increasingly 
begin to crumble [24]. 


9.4 Digitalization of the Everyday World as a Basic 
Precondition for New Mobility Concepts 


The development and extension of carsharing via new concepts such as flexible and 
peer-to-peer carsharing is inconceivable without the availability of devices with mobile 
internet access and communications applications. Every provider does indeed also present 
their carsharing product extensively on the (stationary) internet, but this is more about 
giving information to (potential) customers than immediate use of the service. To access 
the vehicles, mobile applications in particular play an essential role. In the first place, they 
enable the user and vehicle to be located in real time. This allows users to see what 
vehicles are available, and to decide whether they are willing, and able, to make the trip to 
the vehicle (for which, depending on the provider, they currently are given between 15 
and 30 min). As a second step, the mobile application allows the selected vehicle to be 
reserved and offers navigation to it. With some operators, even opening the vehicle can 
already today be done via the app. 

The potential use of such technologies thus depends largely on users being technically 
equipped to access the online choice of available vehicles via mobile. Rates of private 
smartphone ownership have in fact considerably risen in recent years. While only around 
6.5 million Germans owned a smartphone in 2009, this figure stands at over 40 million 
today, almost every second person. For 2014, it is expected that 97 % of all mobile phone 
sales will be smartphones; sales of almost 30 million devices are forecast [25, 26]. 

At the same time, it may be assumed that hardware and software skills are increasing in 
all population groups. In 2013, for example, a study found that the number of internet 
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users continues to expand [27]: in 2013, 54.2 million people in Germany were online at 
least occasionally. That is 77.2 % of the population, and an increase of 800,000 people on 
the previous year. The driver of this growth is exclusively the over-50s. Time spent online 
is rising concurrently: the average German internet user was online for an average of 
169 min a day in 2013, 36 min more than the previous year. A considerable proportion of 
this was mobile internet use, practiced by only 23 % of users in 2012, but already by 41 % 
in 2013. Apps are used by almost half of online users (44 %) on various end devices [28]. 

In the transport context, what particularly stands out is the ever greater possibility of 
reducing planning horizons arising from digital applications and mobile devices. Spon- 
taneity in organizing individual mobility is thus a particularly important connotation of 
“flexibility,” the most common among the specific qualities of the new mobility concepts. 
Correspondingly, the statement with the highest approval rating in a 2014 survey of 
Car2Go users was: “What I find attractive about Car2Go is that I can use a car sponta- 
neously, even when I am out and about without one”—98 % of respondents agreed with 
this statement (for 72 % it was “highly accurate”, for 26 % it was “quite accurate”) (see 
[15, p. 20]). This also goes to explaining the quick success of flexible carsharing, which is 
released from the (long) pre-planning required for conventional station-based carsharing. 
At least in the medium term, it could also take on the advantage that private cars have 
enjoyed until now of being permanently available (on this, see also [22, p. 64]). 

Overall, this means that almost no barriers to access on the part of the (potential) users 
should be expected, provided that future mobility concepts tie in with what is already 
currently practiced (“practiced” in the true sense of the word; for an analogous compar- 
ison, see the acquisition by repeated practice in the interaction between humans and 
computers in vehicle navigation systems in Chap. 3). Less likely, even if repeatedly cited 
by the scientific community, is the conversion of the entire vehicle fleet into vehicles that 
are on the road on a sharing basis or operated by public transport providers. There are 
currently no indications that private cars are losing any of their attraction. According to 
the Federal Motor Transport Authority (Kraftfahrtbundesamt, or KBA), vehicle stocks in 
Germany reached record levels on 1 January 2014, rising by around 500,000 vehicles 
between 2013 and 2014. This accords with long-term trends [29]. 


9.5 Can New Mobility Concepts Be Further Developed 
via Carsharing’s Automation? 


There are a series of variants for the further development of existing carsharing concepts 
using autonomous vehicles, which run in parallel to the use cases outlined in Chap. 2. 
These variants are aimed at different user needs which are already being addressed, albeit 
via a human driver. In the following, we shall discuss the “Full Automation Using Driver 
for Extended Availability,” “Autonomous Valet Parking,” and “Vehicle on Demand” use 
cases, and also ask: What changes would carsharing experience with an influx of 
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autonomous vehicles? What effects can be expected for the user? Competition with 
currently existing transport provision will also be addressed. 

In all use cases, the highest degree of automation is assumed—‘fully automated,” 
according to the nomenclature of the German Federal Highway Research Institute 
(Bundesanstalt fiir StraBenwesen, or BASt) [30]. The difference in the cases lies in the 
uses encompassed in their definition. Autonomous Valet Parking, for instance, exclusively 
involves picking up and parking vehicles. Full Automation Using Driver for Extended 
Availability, on the other hand, covers every conceivable use in road traffic, even if the 
emphasis is on situations with comparatively simple traffic mixes, such as freeway traffic, 
where high speeds also prevail. In this use case, the driver must take over the driving task 
at certain times and on certain route sections where clearance for autonomous driving has 
been temporarily or permanently withheld. A Vehicle on Demand is likewise in a position 
to deal with any potential usage scenario, including those with mixed traffic. By 
renouncing the so-called driver’s workplace—the seat from which the driver performs the 
driving task—the potential uses of the vehicle interior increase greatly in comparison to 
Valet Parking or Full Automation. 


9.5.1 Autonomous Valet Parking in Carsharing 


The Autonomous Valet Parking use case starts from the assumption that the vehicle will 
be able to independently move from parking space to user and vice versa, even on public 
roads. 

The use of Autonomous Valet Parking in carsharing would initially mean that the effort 
required for the user to procure the vehicle and park it after use would fall considerably. 
Instead, from the user’s point of view, there would be a door-to-door service—comparable 
to taking a taxi, although one in which the user takes over the driving task for the actual 
journey. The overall travelling time would in any case be reduced with the shortened time 
and distance for accessing and egressing the vehicle. 

In order to make the service more attractive, various enhancements would be possible, 
regardless of automation. These could be options in vehicle features: number of seats, 
carrying capacity, internet access, and multi-media provision. How greatly the options 
differ would depend—as with today’s carsharing—on the fleet size, the number of (po- 
tential) customers per vehicle and the size of the operating area, and also on the readiness 
of customers to pay for various optional features. In a large fleet, it would also be possible 
to have a differentiated price scale for different vehicles, comparable to that currently 
found in station-based carsharing and traditional car rental. This is in contrast to current 
flexible carsharing business models, which possibly have the added attraction for users 
that they can use a large range of vehicles from the current fleets for the same price. 

With Autonomous Valet Parking, providing vehicles at a station becomes essentially 
superfluous. Carsharing provision as a whole could thus be made flexible—at least in that 
fetching and returning the vehicle would be unnecessary. The operators, of course, would 


182 B. Lenz and E. Fraedrich 


still need their stations or vehicle depots to keep things centralized to a certain extent, 
which is more efficient for vehicle maintenance. These stations, though, would no longer 
need to be built in the greatest possible proximity to customers, but could instead use 
low-cost land. The distance to the journey/start end points is not arbitrary here, however, 
as there may be a relatively small time window for getting to the customer. Moreover, the 
journey to the customer also uses resources and is also “dead” time if no other use is 
possible for the vehicle on the way. 

As an alternative, or supplement, to this, numerous smaller collection points with a few 
vehicles could be spread relatively densely across the operating area. This would keep the 
time between ordering and picking up a vehicle down. A mixed form of vehicle ordering 
with optional autonomous collection or picking up in person would also be possible. This 
would significantly even out access times, which currently still differ widely, depending 
on the density of available vehicles. At present, access times, calculated on the difference 
between the measured values of “time of booking/reservation” and “journey duration,” are 
between 1 and 16 min (e.g. DriveNow with a maximum reservation time of 15 min; 
source: WiMobil project, supported by the German Federal Environment Ministry 
(BMUB)). The differences in average access times are closely linked to the various trip 
purposes. 


9.5.2 Carsharing Used as “Full Automation Using Driver 
for Extended Availability” 


The use case of Full Automation Using Driver for Extended Availability assumes that 
vehicles will basically be able to move autonomously on public roads, but that the driving 
task can be taken over by the driver independently from time to time. 

From a carsharing perspective, the potential changes and extensions involving “Full 
Automation” are far smaller than those of Autonomous Valet Parking, at least when 
drivers are required for on-hand availability in the vehicle. The only difference to today’s 
carsharing that would result from this use case would be the possibility of letting the 
vehicle drive during the trip, should the driver wish. Autonomous driving may also be 
permanently proscribed on some route sections, however, “e.g. roads with a high fre- 
quency of pedestrians crossing” (see Chap. 2). This would primarily be areas in urban 
districts which—at least for now—form flexible carsharing’s main usage areas. 

Accordingly, upgrading carsharing with fully automated vehicles, with the driver 
available for extended range, would be more likely to find use on routes at the edge of or 
outside settlements. But this is hardly the basis for a business model for “carsharing in 
tural areas,” however. The necessity of having a driver available would prevent serving 
operating areas with a vehicle that drives to and from the customer autonomously. 

Overall, the use of Full Automation Using Driver for Extended Availability offers far 
less potential than that resulting from Autonomous Valet Parking. 
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9.5.3 Carsharing as Vehicle on Demand 


The Vehicle on Demand use case assumes an autonomously moving vehicle on all public 
roads. A driver is—even as a fall-back option—not necessary. A driver workstation is thus 
no longer required, which opens up new design possibilities for the vehicle interior. 

A carsharing vehicle on demand starts with the same advantages as a carsharing vehicle 
with a valet parking function, but in addition the vehicle can become a kind of “com- 
partment on the road.” As a result, very diverse activities are possible in these vehicles, 
such as reading, playing, telephoning, working or taking a nap, and the user can sit 
anywhere they choose. If we assume usage durations similar to those generally found in 
today’s flexible carsharing, however, it remains open to question whether these additional 
uses would in fact be highly valued—the average usage duration of a vehicle in a fleet 
such as that of DriveNow, for instance, was roughly only half an hour in 2014 [31]. If we 
assume that autonomously driving vehicles will be used for all work journeys in the 
course of a day, this time span would come to an average of 54 min in large cities at 
today’s rates. For those living in surrounding areas of large cities or in rural areas, the total 
time spent on travelling to work on a weekday is currently 49-50 min (data source: MiD 
2008 [1]). There is, then, almost no difference in the time spent making work journeys 
with cars in various types of geographical areas (Fig. 9.2). 

Carsharing in a Vehicle on Demand would be similar to a taxi ride, and because the 
vehicle would be available to a wide circle of users, it would most probably replace taking 
taxis. But the costs of taking an autonomous carsharing vehicle should be compared to 
those of taking a taxi. 


Fig. 9.2 Commute time for 100% 
commuting by county types 90% 21% 21% 20% 
(data source: [1]) 
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9.5.4 Interim Summary 


If we compare the various possible uses of autonomous vehicles in carsharing, the vehicle 
user gains in comfort from automating the driving task, in a way that is not essentially any 
different from private vehicles. In carsharing, the travelling time is also free for any other 
activities that can be carried out in the vehicle during the journey. The decisively novel 
type of use likely to emerge for carsharing would be delivering the vehicle to the user and 
disposing of it after use. 

The user’s prospects are different to those of the operators, who, with the automation of 
pick up and drop off, will achieve increased usage frequency and overall usage duration 
for a single vehicle, which could increase carsharing’s profitability. This would at least 
even out differences in usage frequency that show up in studies on flexible carsharing. 
Currently, usage frequency is directly related to the location at which the vehicle is left. 
Hotspots in inner-city districts stand in contrast to places where most vehicles parked there 
wait unused for several hours (Fig. 9.3). Operators currently put average usage duration at 
between 68 and 78 min per vehicle per day [32], which shows that there is still room for 
these vehicles to be utilized at greater capacities. 


Ci Hot Spots Munich 
GiZScore 
<:2.58 Std. Dev. 
-2.58 - -1.96 Std. Dev. 
ZW .1% --1.65 Sid. Dev. 
7 WEM -1.65 - 1.65 Std. Dev. 
WE 1.65 - 1.96 std. Dev. 
7 BEE 1.96 - 258 Std. Der. 
€ EN > 2.55 su. dev. 


z 


Fig. 9.3 Booking intensity of vehicles in flexible Carsharing—the example DriveNow Munich [14, 
p. 18]. A high positive value equals a high number of bookings in the respective area (the higher the 
value the more bookings are made). A low value equals a low number of bookings (the lower the 
value the lesser bookings are made) 
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9.6 New Mobility Concepts Beyond Carsharing: Hybridization 
of Public Transportation? 


While carsharing attracts particular attention, especially in its new flexible variant, and 
also in connection with vehicle automation, it is often overlooked that new options for 
(further) diversification in current public transport provision could also result, with further 
new forms of mobility concepts emerging. It also is vital here to take the relevant local 
conditions into account. 

The basic options to be discussed in connection with public transport involve: 


— redesigning intermodality and transition to a more flexible form of public 
transportation 

— individualizing public transportation 

— expanding public transportation service options 


The particular benefit that would arise from the use of autonomous vehicles here 
especially concern demand-driven services: Fixed route plans could be supplemented by 
flexible services. The additional routes could be optimized according to customer 
requirements. Fixed timetables would be replaced by temporally optimized routings 
corresponding to customer demands. 

This individualization of public transport will, then, amount to “hybridization” at the 
latest when, beyond the flexibilization of times and routes, options regarding the vehicles 
available are also on offer. In essence, the idea of diversifying public transport via 
vehicle-specific provision is not new. Until now, however, it has only been possible to 
introduce this in very limited, mostly tourist-centered niches, due to the costs of manning 
the various fleets with the required staff (e.g. Cable Car in San Francisco, the Glacier 
Express in Switzerland, or the Blue Train in South Africa). 


9.6.1 Reshaping Intermodality and Making Public Transport More 
Flexible 


Intermodality is defined as the change between different transport modes in the course of a 
journey [33]. According to this definition, intermodal behavior exists only to a very 
limited extent, at least in Germany. According to the study “Mobility in Germany 2008,” 
it only applies to 1.3 % of all day-to-day journeys [1]. What is overlooked here, though, is 
the considerable amount of intermodality within public transport, particularly in the 
linking of main routes with access and egress routes. A typical example of this is 
accessing commuter or regional trains on a bus line, as is often the set-up in suburban and 
tural areas. In cities, intermodality between the various modes of metro, commuter train, 
trams, and bus is much more pronounced. The situation in urban peripheral areas and less 
densely populated (rural) districts is outlined below. Heinrichs discusses comparable 
scenarios for cities elsewhere in this volume (see Chap. 11). 
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Reshaping intermodality by using autonomous vehicles could take place along the 
same lines as the current system, using private cars or public means. In day-to-day 
transport, getting to and from the main lines would to some extent correspond to what is 
today known as “kiss and ride”: One person drives another to the main route transport 
mode, bids goodbye and takes the car with them so they can use it (generally in the 
daytime) for other purposes during the other person’s absence. With an autonomous 
vehicle, the first person would not need to do the driving, as no driver would be needed to 
be present for the return trip. The kiss-and-ride pattern can also be found in similar form 
for long-distance transport, where carsharing operators have also begun, incidentally, to 
introduce special services for getting to and from airports, train and long-distance bus 
stations. These include reserved parking spaces at airports, and special rates for intermodal 
use of long-distance buses and carsharing vehicles [34]. 

If travelling to and from main lines is done on a public system, it will be possible, by 
means of autonomous driving, to target user requirements far more closely. Fixed routes 
and timetables could be dropped in favor of individually arranged pick-up times and 
locations. A larger fleet of small and medium-sized vehicles would probably be used for 
these journeys; the local public transport system would be one of a multitude of collective 
taxis with tailored capacities. Despite automation, the logistical challenges would be 
enormous. There is also the essential precondition for a functioning system that the user 
sticks to the agreement with the operator very reliably. This is especially true regarding 
departure times, for instance when fixed schedules on the main line, or at least fixed 
timetables, are involved. 

Such a transformation of the system could also breathe new life into ideas of financing 
basic public-transportation services—on the one hand in the form of pay-as-you-drive, but 
also on a flat-rate basis financed via taxes or levied on all citizens, as is often debated for 
cities. Also, a high service density in suburban and even rural areas would justify a 
flat-rate levy and could in the process help to reduce private car use. 


9.6.2 Individualization of Public Transport 


Individualizing public transport via autonomous vehicles could, then, go beyond abol- 
ishing fixed routes and timetables if it actually came to reducing vehicle sizes—at least in 
certain parts of the areas served. This would open up the possibility of offering users 
different vehicle types and features, which presently only exists in a rather rudimentary 
form with first and second classes on public transport, and even there only really on 
medium- and long-distance trains. 

One possible first step in individualizing public transport could be company buses, 
such as the so-called Google Bus, equipped with WiFi access and operating in and around 
San Francisco, which brings the company’s employees to work. In this case, a specific 
community gets together in a communal shuttle. Comparable concepts, albeit in manifold 
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varieties, are conceivable and appear particularly attractive when based on autonomously 
driven vehicles. 

Parallel to this—also as a private initiative—the development of new carpooling 
concepts is also possible, which could mean a mix of common ownership and use of the 
vehicle, though it may be used individually at times too. Today, carpooling is essentially 
restricted to ridesharing organizations, where journeys are planned in the medium or short 
term, and the vehicle is provided and driven by the owner. Even new services such as 
Uber (www.uber.com) or Lyft (www.lyft.com) do not deviate from this principle. What 
they offer is taxi-like services, and are thus not comparable with the standard carpooling 
communities, which predominantly consist of fixed groups of people. It seems reasonable 
to assume that carpooling services will become obsolete with the rise of autonomous 
vehicles, and evolve into peer-to-peer carsharing. 


9.6.3 Broadening Service Options in Public Transport 


Concerning intermodality, possibilities include more public transport services, even in the 
suburban and rural areas mentioned above (for urban areas, see Chap. 11). The benefits 
resulting from the use of autonomous vehicles are equally true in spatial and temporal 
terms, that is both for districts on the outskirts and off-peak hours. An economic lower 
limit resulting from frequency of use also applies here, however, even in view of the saved 
labor costs. This also means that a spatially highly dispersed use can only be covered to a 
limited extent by providing larger fleets. In any case, operating these vehicles would have 
to pay for itself in terms of initial outlay and operating costs. 


9.7 Implementing New Mobility Concepts with Autonomous 
Vehicles 


Carsharing is currently causing quite a stir, in part due to the new forms it is developing, 
its increasing visibility, and how abruptly its user base has grown in the last two years. But 
beyond that, carsharing, which in its commercial or group forms is independent of private 
car ownership, seems well cut-out for introducing new vehicle technologies into the 
market. Users get to use and try out new technology in providers’ vehicle fleets, without 
the costs of doing so that comes with conventional vehicle ownership. In fact, this is 
already taking place with electric mobility, where companies such as Car2Go, DriveNow 
and Citroen’s Multicity service are incorporating electric vehicles into their fleets. The 
user response has been markedly positive. On this point, projects have reported two 
aspects of electric-mobility carsharing: Firstly, the new technology has been successfully 
and speedily furnished for a large section of carsharing users; this has stimulated its use. 
Secondly, many users actively seek out the option that carsharing gives of testing and 
using new technologies [13, p. 15; 15, p. 19]. 
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The introduction of autonomous vehicles into public transport may be more difficult, 
even if automated rail and metro lines have so far largely been positively received, e.g. 
Linie 1 of the Paris Metro, fully automated since 2012 [35], or the metro line to 
Nuremberg Airport [36]. But the spatial separation of rail tracks provides for different 
conditions than would most likely be the case on the roads. If autonomous vehicles were 
also tied to a rigid infrastructure in road transport, then not only would considerable costs 
result, but the possibility of more flexible navigation would also be lost. Testing the 
deployment of autonomous vehicles in prescribed, small-scale public or semi-public areas, 
as described in Chap. 10, thus assumes especial importance. A comparably open “ex- 
perimental philosophy” is not currently visible in many places. 


9.8 Conclusion 


Further developing carsharing systems and changing public transportation through the 
deployment of autonomous vehicles appears in essence possible, and is in many places 
also linked to clearly defined benefits for road users. In carsharing, the use of fully 
automated pick-up and drop-off services, in the sense of Valet Parking, seems to almost be 
a logical and necessary consequence if carsharing’s availability and use are to be extended 
further in the medium-term. 

We can already see that numerous new ideas concerning car and ridesharing are 
cropping up and being tested out, which could have an even greater potential when 
combined with autonomous vehicles. Carpooling schemes are being developed, for 
instance, that have an additional “care” aspect, not only for elderly people, but also for 
children—as “Boost by Mercedes Benz” is demonstrating in Palo Alto, California. We 
also see here the close interconnection between mobility and information and commu- 
nications technology when organizing such services [37]. 

The question of costs and profitability are currently completely open; possibly this 
question should be linked to that of financing the system. On the user side, it also remains 
to be seen whether, and to what extent, users come to accept pay-as-you-drive carsharing 
set ups. Experiments in this area are also only at initial stages. For example, in their 
current version, Spotcar are positioning a distance-based charging scale against Car2Go 
and DriveNow’s time-dependent pricing, in order to avoid immediate cost penalties for 
customers stuck and delayed in city traffic. The pay-as-you-drive era is only just beginning 
in public transport, for instance with systems such as Touch&Travel. It may well be, 
however, that such payment systems in carsharing, and comparable ones in public 
transport, are merely forerunners of a highly flexible system. 
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Deployment Scenarios for Vehicles 1 0 


with Higher-Order Automation 


Sven Beiker 


10.1 Introduction and Background 


Tragically, traffic accidents continue to be an everyday aspect of motor vehicle operation 
as evidenced by statistics. In the United States, for instance, there are approximately 
33,000 traffic fatalities per year [1]; in Germany, the figure is roughly 3300 [2]. Vehicle 
automation, or the gradual delegation of driving from humans to computers, promises to 
drastically curtail the frequency and severity of accidents. Beyond that, automating 
vehicles will improve the overall coordination among them, improving the efficiency, 
comfort, convenience, and safety of personal mobility. 

Automated highways and vehicles have been the subject of research and development 
for over five years now. The question is: how realistic is the vision of humans delegating 
driving to computers in the near future? Currently, several different development routes 
are apparent. On one side, the established auto industry is developing “driver assistance 
systems” with automated driving as the ultimate goal. Meanwhile, non-automotive 
technology companies from the IT sector have identified automated driving as a new 
business area for their core products, while recent start-ups are harnessing advanced 
technology to edge their way into the field of automated personal mobility. A closer look 
reveals that the players listed above have varying strengths and product goals, but are all 
driven by a common mission: to shape a new model of personal mobility that is safer, 
more efficient, more comfortable, and more convenient. This chapter will draw a com- 
parison between these development trends and players. 

The development trends will be treated as distinct deployment scenarios, each one a 
potential projection of how the introduction of vehicles with higher-order automation 
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might play out. The scenarios were developed primarily by extrapolating publicly 
available knowledge on the state of the art for automated vehicles and projecting progress 
forward, while accounting for the outside factors of infrastructure, economics, and 
technology. 


10.2 Definition and Scope 


Automated vehicles, also known as “autonomous,” “driverless,” or “self-driving” 
vehicles, are currently the subject of extensive discussion in the general public, are being 
researched by universities, and developed by the auto industry. This article focuses on 
road vehicles, paying particular attention to passenger vehicles and to some extent trucks. 
It excludes trains, aircraft, and ships. 

In general, the vehicles under consideration are operated on public roads; however, the 
discussion of synergies will also address vehicles that operate in restricted areas such as 
company premises, amusement parks, or pedestrian zones. Distinct from public roadways, 
possible usages in these restricted and/or partially public areas are salient because they 
allow us to observe critical interactions between automated vehicles and the public, which 
is ultimately to the advantage of their deployment in general road traffic. The individual 
implementation scenarios cover such cases in more detail. 

This chapter will follow the taxonomy of automated driving and automated vehicles 
defined by SAE International as J3016 [3], which distinguishes between assistance, partial 
automation, conditional automation, high automation, and full automation. 

To highlight the area under focus, this chapter introduces the term “higher-order 
automation,” which encompasses driving with conditional, high, or full automation. These 
categories merit emphasis because the step beyond the partially automated scenario—the 
point at which the driver no longer has to monitor the vehicle or system continuously— 
entails a fundamental change in what it means to drive a car. The radical shift is that the 
driver can then pursue other tasks during the trip besides operating the vehicle. Finally, a 
“driverless” vehicle would not even require a human driver whatsoever. This will pave the 
way to utterly new models for the operation and enterprise of personal mobility. 


10.3 Development Trends in Automated Driving 


The motives for deploying automated driving—safety, efficiency, extended mobility, 
comfort, and convenience—can be observed for various trends in this field. The individual 
aspects are apparent to varying degrees and depend considerably on the intended 
deployment area and purpose of use. The sections below will examine this in more depth 
by discussing the currently observed development trends. To start off, the next three 
subsections describe the deployment scenarios, reflecting the current discourse among 
both experts and the general public. 
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10.3.1 Continuous Improvement of Driver Assistance: Evolutionary 
Scenario 


One of the principal players in automated driving is the auto industry, comprising both 
vehicle manufacturers and system suppliers. The auto industry has been concerned foremost 
with advancing driver assistance systems, or technology that supports the driver in oper- 
ating the vehicle. Over nearly four decades, such systems have been introduced to both 
passenger and commercial vehicles, assisting drivers with longitudinal and, increasingly, 
lateral control. These systems include anti-lock braking systems (ABS), electronic stability 
control (ESC), adaptive cruise control (ACC), and lane-keeping assist, among others. 

Figure 10.1 shows a timeline for the deployment of these systems. To date, these have 
emphasized increasing safety and, in some cases, comfort and convenience. The 
“evolutionary scenario” refers to the steady increase in the use of advanced driver 
assistance systems followed by successive steps towards vehicle automation and a cor- 
responding reduction in the driver’s responsibilities. This is one of the three deployment 
scenarios to be compared in this chapter. 

For the first time in production vehicles, the auto industry is currently launching a suite 
of systems that automates both longitudinal (acceleration, braking) and lateral control 
(steering), with driver monitoring still to be introduced—in other words, a partially 
automated system. This suite of systems, often called a “traffic jam assistant” [4-6], 
presents a setting that combines adaptive cruise control (automated longitudinal control) 
with lane-keeping assist (automated lateral control) and thus automates control of the 
vehicle along both longitudinal and lateral axes in slow-moving traffic. In this mode, the 
driver’s role is merely to supervise the system and intervene if needed. 
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Fig. 10.1 Timeline for the deployment of advanced driver assistance systems with the vision of 
fully-automated driving (levels of automation as defined by SAE J3016 [3]). Copyright belongs to author 
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The next anticipated development stage is the increasing automation of parking. Today 
there are already many production vehicles that substantially facilitate the processes of 
both angled and parallel parking [7]. However, these systems tend only to take over the 
task of steering, the part that many drivers find more difficult, leaving them in control of 
the accelerator and the brake. As such, these present-day systems fall under the category 
of assisted driving. In the near future, a growing number of partially automated parking 
solutions are expected to offer not only system-controlled steering, but acceleration and 
braking as well. Then the driver’s role is merely to monitor the system, for instance by 
pressing one button throughout the parking process—which remains a signal of the 
driver’s attention and responsibility [8]. 

The recent past has witnessed statements by various automakers announcing the year 
2020 as the target for “autonomous” driving [9-11]. Since the term “autonomous” does 
not have a set definition according to organizations like SAE International, the automation 
level implied by these announcements cannot be stated with certainty. Still, it is fair to 
assume that their functionality would move significantly beyond partial automation and 
maybe even enter the realm of high automation. In such a design, the driver would not 
even need to take over in an emergency within specifically defined use cases and zones, 
for the system is able to perform all driving tasks on its own including responding to 
unforeseen circumstances. 

These announcements, often accompanied by public demonstrations of vehicles with 
higher-order automation, also show that many well-known automakers and system sup- 
pliers are currently working on designs to propel the evolution of driver assistance 
towards higher-order automation [10, 12, 13]. To that end, in keeping with the mission 
described at the beginning, traffic safety is treated as the number one objective with further 
increases in efficiency, comfort, and convenience seen as added benefits. 

However, it is hardly possible to make predictions beyond the target date of 2020. Even 
though several market analysis reports and even some automakers themselves have raised 
prospects of full automation by 2025 [12], this should be seen more as a possible mile- 
stone in the evolution of driver assistance toward automated driving, and not as a reliable 
forecast of when particular system capabilities and features will be available. Due to their 
far-off time horizon, projections of that scope should be considered with caution. 

Under the evolutionary deployment scenario, we can assume that it would take quite a 
while for a significant share of vehicles on public roads to have higher-order automation 
even if such vehicles were for sale as mass-market vehicles by 2020. In the past, it has 
usually taken around 15-20 years before a technology like ABS or ESC becomes a 
standard on all new vehicles or is at least available as an extra option [14]. Since the 
vehicle fleet is generally only replaced over the course of 20 years [15], we should hardly 
expect most vehicles to run without driver interaction in the foreseeable future under the 
evolutionary development scenario. Accordingly, this scenario is a more longsighted but 
also more predictable approach, particularly in comparison to the scenario described next. 
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10.3.2 Redesigning Personal Mobility: Revolutionary Scenario 


Since 2010, non-automotive technology companies [16] have been known to be working 
on automated vehicles. Unlike the evolutionary scenario pursued by the auto industry and 
described above, these businesses are promoting a revolutionary scenario with the stated 
goal to “prevent traffic accidents, free up people’s time, and reduce carbon emissions by 
fundamentally changing car use” [16]. It can be concluded based on such announcements 
and published design descriptions that these players are not pursuing the continuous 
improvement of driver assistance towards automated driving, but rather a disruptive leap 
straight from today’s traffic pattern, with human-driven vehicles, into a scenario in which 
the driver hands over control to the system completely. Obviously this vision is one of 
fully or at least highly automated driving. 

The key design feature from non-automotive technology companies is the inclusion of 
artificial intelligence. In other words, the functionality of automated driving is imple- 
mented by means of learning algorithms rather than the closed arithmetic designs that tend 
to be pursued by the auto industry. This approach attempts to close the gap between a 
purely analytical system operating within narrow boundaries and a rule-based system 
mimicking human behavior. The reason for using learning systems of that kind is that they 
can improve their features, such as object recognition, over time and learn from the user’s 
behavior and preferences. Those are rather unusual traits for a vehicle from the auto 
industry, which conventionally introduces a product with its full range of features that then 
remain static and unaltered. In the computer industry, by contrast, it is standard to 
introduce a product and then steadily extend its range of functions, whether through 
learning algorithms or periodic software updates. 

Whereas the deployment strategy under the auto industry’s previously discussed 
evolutionary scenario seems relatively straightforward, the same is not necessarily the 
case in this revolutionary scenario. After all, these are players from the IT industry with no 
prior experience with automobiles [17-21], and they are pursuing a highly complex goal 
in an area outside their specialty that may not fit well with their core business. Although it 
is public knowledge that these firms have already driven several hundred thousand miles 
in vehicles with higher-order automation [22], their ultimate product goals remain unclear. 
To date, the players pursuing this revolutionary scenario have made scant mention of 
tangible plans for any launches on the market, and it is unsure whether these 
non-automotive technology companies intend to establish themselves as vehicle manu- 
facturers [23, 24]. So far, a range of deployment deadlines have been estimated [25, 26], 
which in conjunction with other observations in the field give way to the following 
deployment scenarios. 

It is conceivable that the test drives of vehicles with higher-order automation that are 
currently underway will serve as a platform for the acquisition and subsequent usage of 
maps and images aiding automated driving. The non-automotive technology companies 
could then offer services and online software products as part of automated driving and 
thus propel vehicle automation forward on a broad level. If so, the associated mapping and 
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graphical information could be furnished for broader use, which would be more consistent 
with a continuous rather than a revolutionary deployment of automation. 

However, once the vehicle is driving self-sufficiently without the need for supervision, 
the goal of those non-automotive technology companies might be for the driver to con- 
sume the products from their core business, i.e. online services. In that case these players’ 
strategy would be taking quite a long-term view focused on revenue in their core business: 
the attempt to conquer the remaining segments of the market—transportation—as part of 
connected lifestyle. In other words, if the drivers were surfing the web or using social 
media during the trip, that would make them potential customers for online services just as 
much as any other computer user. 

Another deployment scenario that seems a better match for the industry’s tendencies and 
also allows for a revolutionary development can be deduced from the industry’s public 
design descriptions [24], press releases [22] and patents [27]. On that basis, the deployment 
of vehicles with higher-order (perhaps even full) automation for services such as the 
transportation of passengers [28-30] and goods [31] appears possible even within the near 
future. One credible possibility could be the introduction of vehicles with higher-order 
automation as competitors of conventional taxis. Press releases [22] and media reports [24] 
seem to favor a deployment scenario along those lines, though they provide only sparse 
details about the true objectives and development stage of the technical implementation. 
This use case is described in this book under the category “vehicle on demand.” 

One variation of automated taxicabs is the idea of delivery services with higher-order 
automation, such as food deliveries [32-34] home delivery from local retail outlets [31], or 
deliveries of any sort of products ordered online [18]. Designs for those kinds of applications 
have already been demonstrated publicly. Based on strategic investments and acquisitions of 
the leading companies in these areas, the increasing automation of product delivery is a 
potential application of vehicle automation. Trials of “drones” for delivering goods [18, 32, 
33] and automated garbage removal [35] may also point in that direction (Chap. 16). 

Even though many questions remain unanswered, this decade may yet see a large step 
towards higher-order vehicle automation. This may seem minor and very limited at first 
(for example, fully automated taxis in one neighborhood), but its implementation area 
could grow rapidly along with its market share. Announcements by leading companies 
support the hypothesis that vehicles with higher-order automation will be rolled out before 
2020 [22]. 

By starting with a limited deployment, non-automotive technology companies would 
have the opportunity to start gathering ample experience and data in the near-term, 
including the public reaction to these novel concepts. That would pave the way for them to 
apply their insights to expansion on a regional, national, and finally global scale. 
A deployment strategy of this sort would be anomalous for the auto industry and could 
even damage the reputation of a company that tried it. For non-automotive technology 
companies, however, it is standard practice. Indeed there are examples from past product 
launches where it has even benefited companies’ reputations, as a limited introduction 
entails a certain kind of exclusivity [36, 37]. 
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10.3.3 Merging Personal Mobility and Public Transportation: 
Transformative Scenario 


Another deployment scenario for automated driving involves implementing transportation 
paradigms that provide slow-moving passenger vehicles, for example in urban areas. 
Consumers could summon such vehicles using a smartphone app and ride them over 
relatively short distances (see the use case “vehicle on demand”). Key drivers behind these 
types of schemes tend to be high-tech start-ups but may also include transportation service 
providers, municipalities and operators of facilities such as amusement parks. Their goal is 
to combine the advantages of personal mobility (independence and flexibility) with those 
of public transportation (efficient use of energy and space) in order to achieve the mission 
described at the beginning with a priority on reducing urban traffic congestion (Chap. 9). 

Start-ups are motivated to enter these areas in order to develop new business models 
and deploy new technologies. In particular, companies from unrelated sectors can use 
image processing, object recognition, and route planning systems—which are already in 
widespread modular use—to implement transportation models with higher-order 
automation within a limited geographical range. The arrangements often proposed for 
market introduction are slow-moving and limited-area vehicles intended to serve what is 
known as the “first or last mile,” complementary to private automobiles or public trans- 
portation. To name one concrete example, these types of solutions could be used to reach 
bus and urban rail networks in areas where a regular schedule is not feasible due to 
inadequate infrastructure or financial limitations. Another example might be a 
“park-and-ride” system, whereby users drive their cars to a parking lot on the perimeter of 
a city or amusement park and transfer to a locally run transportation service. These 
arrangements would be favored for use primarily in places where private cars are not 
convenient or permitted or where buses with set schedules are not flexible enough. 

These transportation solutions would compete with conventional taxis but be more 
affordable, comfortable, and innovative from the standpoints of both users and operators 
[38]. Based on their features, these arrangements have also been called automated 
mobility on demand (AMOD) systems. They represent an individualization of public 
transportation with the aim of transforming traffic in urban areas (Chaps. 9, 11). Com- 
panies’ incentive to introduce such arrangements is to gain access to new business areas or 
extend their range within existing markets. Currently, the taxi industry’s business model 
has comparatively high labor costs. Automated vehicles’ reduced need for human 
resources is anticipated to boost profits [38], though it would be accompanied by a 
reduction in employment in the sector. 

It is quite conceivable that, by merging personal mobility and public transportation, 
automated vehicles will usher in a transformation of urban street traffic. Since these 
systems are only intended for a limited geographical range and would operate at low 
speeds, the difficulties are correspondingly reduced, and they would be much easier to 
implement in the near term than the first two scenarios discussed here. As such, it seems 
realistic that various cases of AMODs will be rolled out with limited scope by 2020. 
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Some early examples of the transformative scenario are already being implemented or 
are scheduled for the near future [24, 39-43]. It should be noted that a number of cities 
have conditions consistent with these use cases, allowing the operation of AMOD systems 
on a trial basis at the least. During the trial period, it remains to be seen whether residents 
will take advantage of the services and whether this will develop into a profitable business 
model. Although the first implementations should be considered extended trials on the 
spectrum between public prototypes and actual commercial deployment, these cases 
represent the most concrete step to date towards the implementation of vehicles with 
higher-order automation. The two other scenarios (evolutionary and revolutionary) may 
well learn from these experiences. 

Due to the generally rather favorable conditions, it is anticipated that various individual 
city governments and operators of amusement parks, shopping malls, and other large-scale 
facilities will introduce automated transportation systems in the short term. On that basis, 
it also seems very likely that as the list of successful role models lengthens, by the end of 
this decade the field will already have a broad range of experiences to draw on and 
automated vehicles will have won the acceptance of their users and other people on the 
road. Despite the inherent simplifications—in view of the limited geographical range and 
low travel speeds—the evolutionary deployment scenario can also extract lessons from it 
to apply to the use of automated vehicles on public streets and highways. Even the limited 
use case of high or full automation with AMODs will furnish significant insight into the 
interaction between automated vehicles and other road users (including conventional 
vehicles, pedestrians, and cyclists) as well as the necessary safety/security measures and 
infrastructure requirements for later deployment on public roads. It is likewise fair to 
assume that the initially limited ranges of AMODs will expand over time. Accordingly, an 
automated transportation arrangement will gradually spread out onto public roads where it 
will interact with conventional and/or automated private vehicles. 


10.4 Comparison of Scenarios 


Now that the previous section has presented the deployment scenarios individually, the 
following section will compare them on several levels. As demonstrated above, these 
scenarios have both differing and shared objectives in terms of the advantages for users, 
commercial operators, and road traffic at large. The section below will spotlight differ- 
ences in more detail but also draw attention to commonalities. 


10.4.1 Systemic Comparison 


The systemic comparison of the three deployment scenarios summarized in Table 10.1 
provides an overview of the use cases for driving with higher-order automation, 
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Table 10.1 Characteristics of the deployment scenarios under consideration 


Evolutionary Revolutionary Transformative 
Degree of Partial/conditional  Conditional/high/full High/full 
automation 
Geographical Unlimited Regional local 
range 
Operated by Laypeople Trained personnel and/or Trained personnel 

laypeople 

Usage Individual/private Individual/private or public individual/public 
Ownership Individual/private Central/commercial central/commercial 


comparing and contrasting each scenario’s objectives, potential implementations, and 
business models. 

As described at the beginning, all three scenarios share the objective of raising the 
safety and efficiency of road traffic as well as increasing mobility and convenience. 
Beyond that, they exhibit increasing specialization in terms of the intended usage of a 
vehicle or assistance system. For example, when it comes to private cars, driving with 
higher-order automation will initially only be offered for highways or parking, in other 
words, specific driving situations. Likewise, new transportation arrangements will only be 
deployed at first in restricted areas such as shopping malls or amusement parks, in other 
words specific geographical ranges. This would result in a more distinct specialization of 
driving or system features than is currently the case. Today, private vehicles are expected 
to be usable by “anyone, anywhere, anytime.” In other words, as long as they have a 
driver’s license, anyone can drive a car no matter the time or place. With the advent of 
driving with higher-order automation, users may face a scenario in which the use of a 
vehicle is more limited or case-specific, requiring a mental adjustment. 

These limitations are highlighted in Fig. 10.2, which contrasts the degree of automation 
with the geographical range. These two factors are perhaps the most crucial characteristics 
for classifying automated driving and allow us to draw an effective comparison between 
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Fig. 10.2 Potential implementations for automated driving by degree of automation and 
geographical range. Copyright belongs to author 
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the three deployment scenarios presented here. The evolutionary scenario, entailing 
ongoing advancements to driver assistance systems, is intended for an unrestricted geo- 
graphical range such as “all highways” or “any parking space.” On the other hand, it only 
offers a comparably low level of automation to start out with. By contrast, the revolu- 
tionary scenario, which aims at redesigning personal mobility entirely, and the transfor- 
mative scenario, which provides for the merging of personal mobility and public 
transportation, both imply a very high degree of automation. Both cases would con- 
ceivably involve the rapid development of fully automated technology, albeit within a 
limited geographical range such as a particular neighborhood, a shopping mall, or an 
amusement park. For the sake of simplicity, one might say that the evolutionary scenario 
is moving toward the goal of full automation with the strategy of an “unrestricted geo- 
graphical range but limited automation,” whereas the revolutionary and transformative 
scenarios are pursuing the approach of a “restricted geographical range but unlimited 
automation.” 

One particularly interesting aspect illustrated by the comparison in Fig. 10.2 is the fact 
that the revolutionary scenario does not especially stand out on either axis compared to the 
evolutionary and transformative scenarios, yet overall it is the scenario that most closely 
approaches the ideal of a fully automated vehicle with unrestricted usage. Thus this 
scenario seems most consistent with the paradigm of “anyone, anytime, anywhere,” as it 
combines a comparatively large geographical range with comparatively high automation. 

In regard to the transformative scenario, the question of who would operate the 
vehicles deserves special attention. It is anticipated that trained, specialized personal 
would monitor the vehicles’ operation or at least inspect them on a regular, perhaps daily, 
basis. As such, that scenario is highly distinct from the model of a privately operated car, 
which is generally operated by laypeople and rarely requires the attention of specialized 
personnel except for occasional maintenance or servicing. For that reason, the “anyone, 
anytime, anywhere” model poses a particular challenge for the evolutionary scenario, 
because it would require extremely high dependability even without ongoing supervision 
by specialists. Notwithstanding, the revolutionary and transformative scenarios prove to 
be helpful in preparation for the advent of individually used private cars with higher-order 
automation, since the operation of such vehicles under specialists’ supervision would lead 
to useful insight early on. 

One potential use case for vehicles with higher-order automation, which is quite sig- 
nificant but cannot be directly attributed to one of the three development scenarios, is the 
prospect of an automated platoon on highways. In this use case, a number of vehicles that 
are otherwise used individually join together into a virtual train by means of a common 
communication infrastructure. This allows longitudinal and lateral control to be auto- 
mated, although it would also require a special communication standard and only vehicles 
compatible with it could be included. At least at the beginning, the first vehicle in such a 
platoon would be driven by a professional driver; all the vehicles following it would not 
require any ongoing supervision and the drivers would only need to intervene in excep- 
tional cases [44]. 
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The scenario of an automated vehicle platoon brings together various traits of the 
evolutionary and transformative scenarios that make an implementation of such a scheme 
within general road traffic seem likewise realistic for the near future. On the one hand, this 
scheme would pose a near-term opportunity for an implementation of vehicles with 
higher-order automation, as the potentially limited object and situation recognition 
capabilities could be augmented by the lead driver’s performance and experience. On the 
other hand, it may pose additional issues, such as the logistics of how to join and leaving 
the platoon, passing by other vehicles, and adhere to the legal following distance. 


10.4.2 Technical Comparison 


The systemic comparison has already revealed several differences among the deployment 
scenarios, which also have divergent requirements for reliability or, more precisely, the 
completeness and availability of the technology needed. Since the evolutionary scenario 
focusing on individually used private cars must function for any layperson without 
temporal or geographical limitations, it gives rise to different technical requirements from 
those of the transformative scenario, for instance, where a fully automated vehicle might 
be operated exclusively in a geographically limited zone under professional supervision. 
Furthermore, the number of vehicles in question and the corresponding number of system 
components may vary greatly, which bears an impact on the technology to be deployed. 

To generalize, the evolutionary scenario requires sensor and processor components that 
are highly failsafe (i.e. redundant and equipped with fallback systems), low-maintenance 
(i.e. self-calibrating and self-monitoring), and cost-efficient (i.e. mass-produced) in order 
to guarantee maximum availability (see Table 10.2). The transformative scenario, how- 
ever, favors specialized, highly accurate, and individually configurable systems that 
enable maximum automation despite an early implementation deadline, even if that means 
more work preparing the infrastructure. What makes the infrastructure for the transfor- 
mative scenario especially labor-intensive are its need for a communication system that 


Table 10.2 Qualitative comparison of the system requirements for the three deployment scenarios 
under consideration 


Evolutionary Revolutionary Transformative 
1.1.1 Reliability ++ ++ $ 
1.1.2 Accuracy + ++ feof 
Configurability 0 dé ++ 
Maintenance needs = + un, 
1.1.3 Operator supervision = + un 
System cost = + FF 


Legend ++ (high), + (significant), 0 (neutral), — (low), — (not applicable) 
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allows the safe and coordinated operation of fully automated vehicles as well as the need 
for a maintenance and supervision crew to ensure the vehicles’ functional safety by 
servicing them regularly as needed. 

The requirements for the revolutionary scenario, in which automated vehicles are 
deployed within functional and geographical limitations, lie somewhere in between the 
technical requirements of the evolutionary and transformative scenarios, as it implies the 
use of a centrally operated and professionally maintained fleet of vehicles that is not 
necessarily subject to ongoing supervision. Thus it requires highly failsafe and precise 
systems that would presumably lead to comparatively high cost. 

The implementation of a communication infrastructure for vehicles with higher-order 
automation is especially significant for the deployment scenarios. Communication both 
among vehicles and between vehicles and infrastructure could be employed to exchange 
data on vehicle positions, vehicle speeds, and other parameters, which would then be used 
for routing or perhaps for a central vehicle coordination system. The trend toward auto- 
mated vehicles in the industry would therefore benefit from another current trend which is 
toward connected vehicles. In that context, it is also particularly significant that there are 
government initiatives in various countries aiming to lend momentum to the development 
of vehicle-vehicle and vehicle-infrastructure communication [45—48]. 


10.4.3 Regulatory Comparison 


The three scenarios can also be differentiated by the regulation that would apply to them. 
Since the vehicles under the evolutionary scenario are intended to be operated on public 
roadways without any geographical or temporal restrictions, their use must be subject to 
the corresponding traffic regulations. As a result, it remains unclear at this point which 
legal jurisdictions allow automated vehicles to be operated under their purview and to 
what extent they may be automated. 

In the case of the transformative scenario, however, the circumstances are somewhat 
different. Particularly due to the anticipated geographical restrictions of use—initially 
outside of public roadways as well as other areas with unrestricted access (instead 
favoring locations such as shopping malls or amusement parks with their own access 
rules)—a special set of regulations may be implemented. That means that either special 
rules will be established for the area where the automated vehicles are operated, access to 
it will be restricted to a specific group of people, or everyone who enters the site will be 
required to declare their consent. The final arrangement in particular would make oper- 
ations considerably easier, as the operator’s liability or mandatory supervision require- 
ments could be regulated based on specific needs. 

In terms of legal requirements, the revolutionary scenario falls in between the evolu- 
tionary and transformative scenarios. If we assume that such systems are initially limited 
to a certain geographical area, such as a neighborhood or a particular highway segment, 
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the area would be subject to general road traffic regulations but there could conceivably be 
special additional rules, such as targeted restrictions, authorizations, or liability regimes 
that would apply solely to that route. 

In terms of applicable regulation, it is also important to keep in mind how regulators 
treat vehicle automation in their own jurisdictions. In the United States, for example, some 
States (the pioneers being Nevada, Florida, and California) have instituted regulatory 
frameworks governing the operation of vehicles with higher-order automation, albeit in 
many cases only for trial runs so far. Meanwhile on the federal level, the National 
Highway Traffic Safety Administration (NHTSA) has urged caution and recommended a 
coordinated introduction alongside vehicle-vehicle communication [49]. The government 
of Japan has expressed its advocacy of the strategic objective of automating road traffic 
and has offered to support the industry to that end [50, 51]. In Europe, governments 
remain cautious when it comes to automation—apart from ongoing participation in 
research ventures [44, 47, 48, 52-54]— though it is anticipated that the topic will received 
intensified attention in the years from 2015 to 2020, as evident already from the earliest 
proposed legislation [55] (Chap. 25). 


10.4.4 Comparison of Corporate Strategies 


The description of the deployment scenarios above has identified the lead players and 
categories of companies involved in each of the three cases. The evolutionary scenario 
appears to be pursued more so by established vehicle manufacturers and system suppliers, 
while the revolutionary scenario is favored by non-automotive technology companies 
from the IT industry and the transformative scenario is advocated by start-ups and service 
providers. 

Table 10.3 presents the three categories with the companies’ characteristics, objectives, 
and strategies. Thus established automakers can draw on experience and processes 
allowing them to implement development projects related to automated driving with 
appropriate planning certainty and see them through all the way to the product launch. 
This is primarily rooted in the evolutionary approach, where the existing development, 
production, and sales processes are extended to a new class of product (automated 
driving). That model makes it rather difficult for them to deploy completely novel 
products or processes. Another characteristic of the auto industry is that its existing market 
positions and company histories lead it to proceed in a manner perceived by outsiders at 
times as rather cautious. 

The auto industry’s caution might be rooted in the fact that these companies have 
established and refined their reputations and brand images among customers over a period 
of decades, making their company names valuable assets worth protecting (Chap. 32). The 
companies’ reputations can be rapidly jeopardized by unreliable or unsafe products, which 
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Table 10.3 Comparison of various corporate strategy characteristics for each of the deployment 
scenarios 


Evolutionary Revolutionary Transformative 
1.1.4 Key Auto industry Non-automotive High-tech 
player (manufacturers, suppliers) technology companies start-ups 
Objective Bolster market position; Explore new business Create new 
improve safety, comfort, and models, extend core services for 
convenience business urban mobility 
Competencies, — Testing, backup systems — Artificial — Image 
characteristics — Production intelligence processing 
— Distribution marketing/sales - Digital mapping — Sensor 
operated by — Public trials technology 
— Maintenance — Unconventional — New products 
products and business 
— Online services models 
— New business models - Lean, 
unconventional 
processes 


can have a long-term impact on their commercial success. Along these lines, introducing 
automated vehicles prematurely is seen as an especially risky move. Indeed, such reser- 
vations are justifiable, as evidenced by numerous instances where automotive products 
failed to meet customer’s expectations or aroused suspicions of safety risks and con- 
sumers proceeded to respond negatively to the associated brands [56-59]. Reservations of 
this nature, whether justified or not, may cause a delay in the market introduction of 
automated driving technology, which has strong safety implications and is centrally 
important to the public interest. 

In contrast, such considerations are much less relevant for start-ups pursuing the 
transformative scenario, as these companies tend not to have long histories or an (auto- 
motive) brand image to protect. At the same time, they do not have years of experience 
developing, producing, and selling cars. This makes these companies better placed to 
develop and launch extremely novel products and services as required by the transfor- 
mative scenario described above. In the event that a product fails to meet the market’s 
expectations, these companies do not bear the risk of jeopardizing a company name that 
has been developed over time. 

Moreover, start-ups are often able—or practically forced—to develop alternative 
processes and product solutions due to their frequently small size. For that reason, 
start-ups have more flexibility in the concepts of automated driving that they design and 
can pursue implementations with greater inherent risk. Yet the start-ups must also over- 
come the challenge that developing automated vehicles is often only feasible by means of 
a high capital investment due to the complexity of the systems and components involved. 
Likewise, it may take a relatively long time before a product is completed and generates 
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any revenue. As such, these companies are often reliant on venture capitalists and their 
longevity can sometimes be uncertain. 

Once again, the revolutionary scenario lies somewhere between the other two. As 
explained earlier, the players in this area are often non-automotive technology companies 
that have access to sufficient capital and can also capitalize on processes that have not yet 
been applied to automotive product development. For those reasons it seems plausible that 
a revolutionary scenario can be anticipated from that precise sector. In fact, this type of 
company has already begun gathering significant experience in transportation systems; for 
instance, one of the companies from the IT industry has already traveled over a million 
kilometers using vehicles with higher-order automation [22] and has prior involvement 
with the transportation of passengers [28] and goods [31]. 


10.5 Summary and Outlook 


This chapter explored three scenarios for the deployment of vehicles with higher-order 
automation: the continuous evolution of driver assistance systems by the established auto 
industry, the revolution of personal mobility by non-automotive technology companies, 
and the transformative merging of private and personal mobility by start-ups and trans- 
portation service providers. At this point, these seem to be largely independent devel- 
opment paths that occasionally compete. However, in regard to the deployment of driving 
with higher-order automation, there are synergies to be exploited, particularly in the areas 
of infrastructure and public acceptance. It should also be noted that all three deployment 
scenarios ultimately work towards the same final scenario, which is for the vehicles that 
are currently driven by humans to be fully automated in the future, giving rise to new use 
cases and business models and an altered set of transportation behavior. 

The differences between the scenarios highlight the likelihood of vehicles with 
higher-order automation being introduced in different geographical ranges with varying 
sizes and in varying regions. It is also anticipated that the scenarios will be introduced at 
different points, resulting in a staggered timeline. To generalize, it is fair to predict that the 
sequence of public introductions over the coming decades will lead from the transfor- 
mative scenario to the revolutionary scenario and finally to the evolutionary scenario. The 
geographical range of these systems would grow from the local level to the regional scale 
and finally become global. 

We can also expect that in addition to the fully automated, slow-traveling and 
limited-area transportation options that are currently being introduced in extended trials, 
there may be local fully-automated taxi services by the end of the decade, which will lead 
the way for the general operation of vehicles with higher-order automation on highways, 
country roads, and urban streets in the years after 2020. Over the next few decades, this 
development will allow us to exploit many opportunities to increase the safety, efficiency, 
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convenience, and productivity of personal mobility. Beyond the clear synergies among the 
various scenarios, they also offer valuable links to the automation of other vehicle classes 
in settings that span from logistics centers and container ports to agriculture and mining, 
perhaps even robotic missions to explore far-off planets. 
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Autonomous Driving and Urban Land Use 1 1 


Dirk Heinrichs 


11.1 Introduction 


Mobility, transport and land use patterns in urban areas are closely bound up with each 
other [1]. Urban form plays an important role when households and businesses make 
mobility decisions, and to a considerable degree dictates transport mode choice. Compact 
city form with high density and mixed use provide good preconditions for short trips and 
efficient public transportation, promote walking and cycling, and often render daily car use 
unnecessary. With sprawling, sparsely populated land uses, on the other hand, walking 
and cycling are discouraged, while car use is favored. In turn, the availability and use of 
designated transport modes strongly influences urban form and the necessary infrastruc- 
tures. The residential suburbanization of the latter half of last century was thus to a great 
extent encouraged by car availability and the expansion of the transport infrastructure for 
motorized passenger transport [2]. 

It is expected that fully automated driving will entail a completely new transport system, 
which will not only bring with it new possibilities in traffic management, but will also generate 
completely new types of transport provision that will affect the choice and use of available 
transport means (see Chap. 12). The idea, for example, that time in a vehicle does not have to 
be spent on driving-related tasks, but instead permits other activities, may instigate a complete 
reappraisal of the time factor (e.g. [28]). This ability to attend to other activities in an 
autonomous vehicle may imply that long car commutes will be considered less a burden than 
today. This could increase the willingness of households to locate further away from the city 
center where land prices and rents are lower and where suburban preferences like living in a 


D. Heinrichs (X) 
German Aerospace Centre (DLR), Institute of Transport Research, 12489 Berlin, Germany 
e-mail: Dirk.Heinrichs @ dlr.de 


© The Author(s) 2016 213 
M. Maurer et al. (eds.), Autonomous Driving, 
DOI 10.1007/978-3-662-48847-8_11 


214 D. Heinrichs 


greener environment can be better satisfied. In other words: autonomous driving can 
potentially alter the trade-offs that households make between choosing location and daily 
mobility. If we take these connected factors to their logical conclusion, in the end it would be 
possible to dissolve the time factor as a limiting variable of urban planning. Will the avail- 
ability of fully automated vehicles then entirely redefine the interrelationship of mobility and 
urban land use? With few exceptions [3], this question remains as yet untackled. Currently, 
visions of integrating autonomous vehicles into the urban transport system still essentially 
refer to the development of vehicle technology itself and the effects on traffic flow. 

In light of this, this article’s aim is to try to gauge potential urban-structure develop- 
ments under the influence of a transport system with autonomous vehicles. Equally, it is to 
identify the way in which political and economic frameworks can influence these 
developments. The following questions are considered here: 


— What future possibilities are conceivable for a transport system transformed, or 
transformable, by automated driving? 

— What effects on urban structures—particularly on their density, mix of uses and layout 
—ight be linked to this in future? 

— What influencing factors are particularly significant in developing a transport system 
with automated cars in cities? 

— What aspects should definitely be incorporated into the debate on autonomous driving 
from the urban planning and development perspective? Also, though: In what way 
should the discussion on the development of cities take up the subject of “the 
automation of transport”? 


As a basis for the examination of these questions, this article will evaluate currently 
available scenarios on the city of the future. The following Sect. 11.2 introduces the 
scenarios and visions of “the city of tomorrow” available in the literature, and their ideas 
regarding the integration of autonomous vehicles into transport systems. It will then 
describe what different future possibilities can be conceived for a transport system that is 
transformed, or transformable, by automated driving, in which urban structures they can 
develop, and which essential influencing factors are essential for this development. 

Building on this, Sect. 11.3 contains a close analysis of the possible “fully automated” 
transport system of the future, based on two idealized scenarios developed by the authors. 
At the core of these scenarios are (a) autonomous private vehicles, and (b) autonomous 
vehicles as an integral part of public transport. Based on a short characterization of both 
scenarios, we analyze what the future effects of each scenario on urban structures might be. 

Section 11.4 discusses what factors might be especially significant in developing a 
transport system with automated vehicles in cities. We will identify the driving forces for 
the scenarios under examination. 

The concluding Sect. 11.5 summarises the essential findings. It outlines what aspects 
definitely should, from an urban planning and development perspective, be brought to the 
debate surrounding automated driving, but also asks how the discourse on urban devel- 
opment and planning should embrace autonomous driving. 
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11.2 Autonomous Driving as a Feature of City-of-Tomorrow 
Scenarios 


As automated driving in cities has not yet become reality, and the effects on urban 
structures are thus not yet observable either, scenarios offer one possibility of drawing on 
conceivable future developments and their interrelations. Scenarios describe both a 
potential future situation and the development of the path leading from today into the 
future [4, 5]. They are a recognized instrument for uncovering and structuring changes, 
their drivers and consequences, in a partly unknown, uncertain and rapidly changing 
environment [6]. 

For the following account, a systematic analysis was carried out of the available literature 
on the city of the future that deals with the development of mobility and transport. From the 
full range of studies, a selection of core documents and scenarios contained therein were 
considered for a more detailed analysis. They met the following criteria: a traceable account 
of set objectives, their status and a development path; the identification of driving forces and 
their interdependencies; and a treatment of the topic of mobility and an account of its 
interrelationship with settlement structure. Finally, these documents were grouped 
according to similarity of type. We then analyzed the forms and significance of automated 
driving they describe, and the changes that significantly impact this trend. The classification 
proceeded along two axes of uncertainty which are particularly relevant when examining 
automated driving: the availability and integration of intelligent communications infras- 
tructure (low or high), and the acceptance and use of this infrastructure in general, and for 
mobility, by the urban population (characterized as fragmented/low, or high). 

The scenarios described in core documents can essentially be classified into three 


types: 


— The regenerative/intelligent city 
— The hypermobile city 
— The endless city 


These scenarios will be described more closely below. 


11.2.1 The Regenerative and Intelligent City 


A series of future studies have highlighted the development of so-called regenerative cities 
as a possible development path [7-12]. These studies view technological developments 
that use resources in an efficient and environmentally friendly manner as being the heart 
and driving force of urban development from 2030 to 2050. At their center is 
energy-related building conversion (solarization, energy-plus houses) and the increasing 
use of locally generated power from renewable sources, which is distributed and shared 
over so-called microgrids or peer-to-peer power systems. This is supported by intelligent 
control mechanisms which allow a link-up with other areas of urban functions, such as 
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mobility. The significance of intelligence and information is highlighted in the corre- 
sponding studies. They describe the transformation into a technological regime that is no 
longer characterized by technologies for individual sectors (energy, transport, waste etc.) 
but rather guarantees a high level of integration between sectors. 

This technological development is accompanied by a transformation in the behavior of 
the urban population [7]. In general, sustainable consumption is assumed as a very con- 
scious and responsible way of dealing with resources [9]. This is explained by the con- 
suming urban population having a greater wish for well-being and quality of life in future, 
which are defined differently to economic well-being. Society will accept 
energy-optimized, and sustainable mobility because the majority of the population not only 
has its advantages presented to them in the media, but can also experience them in daily life. 

The key to this lies in densely populated metropolitan areas, in which a wide range of 
integrated but simple and affordable mobility provision is assured. Cities are characterized 
in this scenario as places that, due to their density, allow efficient use of resources. To this 
is added the assumption that, with the growing significance of cities as economic and 
social centers, the potential of taking decisions and action at city level will increase in 
future. A number of the studies we analyzed state that cities such as London have already 
demonstrated the possibility to transform urban infrastructure, and implement decentral- 
ized, innovative approaches to energy and waste, without needing national policy. Cities 
transform themselves, driven by competition (between cities), policy and city government, 
which actively seek to improve the qualities of the location. 

In the course of the resource-efficient transformation of the city, the conditions of 
mobility in the regenerative and intelligent city also change. Information and communi- 
cation technology is becoming increasingly pervasive in the transport system. The studies 
analyzed see in this a basis for expanding demand-oriented mobility-management 
approaches, and the linking of transport provision with a flexible, multimodal transport 
system in the future (see Chap. 9). Public transportation’s role as the backbone of urban 
mobility is being further expanded and continually modernized, for example in integrated 
planning, with walking and cycling as part of ecomobility, whose share of road space is 
increasing. Supplementing this, citizens also have individual transport modes at their 
disposal (bicycles, e-bikes, electric cars and transporters), indeed precisely when and 
where needed by an individual (“mobility on demand”). This “sharing” provision, fol- 
lowing the principle of “using not owning,” is being introduced and extended by various 
providers and helps to greatly reduce the amount of public space currently taken up by 
private cars. A personal, mobile and electronic mobility assistant allows all the available 
means of dealing with daily mobility to be weighed up, and situation-specific optimal 
variants to be selected. 

One topic of the studies is the further development of electronic assistance systems for 
cars, in conjunction with the development of new, more efficient drive types. It is assumed 
that privately owned cars will also continue to have some significance in future [11]. 
Various studies expect vehicles, with electronic assistance systems for semi-autonomous 
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use fitted as standard, to be present in the period 2030-2050. On freeways with high 
transit volumes or on commuter routes, for example, they allow driving on autopilot, 
which optimizes the traffic flow. This is assured through high-level interconnectedness 
and communication between vehicle and the transport infrastructure. This development 
will be enabled by new legislation regarding licensing, insurance and liability, as well as a 
range of acceptance-generating concepts from the state concerning data management and 
standardization (open source, interface compatibility, data protection and security). 

As part of the changes in mobility provision, the studies we analyzed also describe a 
transformation in cities’ urban spatial structure. The interlinking of transport provision, 
according to these authors, increases the formation of so-called mobility hubs, which can 
already be seen today. It is assumed that city districts will be organized around these hubs 
in a polycentric urban structure in future. Land consumption for parking spaces in urban 
areas will have clearly fallen. The reasons for this are a dynamic distribution of vehicles in 
city districts, and automated, space-saving “parking racks.” 


11.2.2 The Hypermobile City 


The hypermobile city, as a potential development path, is a particular focus in a study by 
the Foresight Directorate of the UK Office of Science and Technology [7]. It outlines the 
development of a society, up to 2055, in which uninterrupted information, consumption 
and competition are the norm [7]. 

This scenario, like that of the regenerative city, also assumes that any remaining 
barriers to the majority of society using individual transport will be overcome, but with 
continued very high demand on resources and the corresponding environmental conse- 
quences. One essential element and driver of this growth is acceptance of the development 
of electronic and digital infrastructure. This could involve using cameras for virtual 
exchange, for example, or personal information assistants. If acceptance is currently still 
low, it will markedly increase in coming years due to its commercial and lifestyle 
advantages. People in the city of the future will be “always on,” whether at home or work. 
To manage this, they will use personalized assistants equipped with encryption technology 
to help them in extensive organizing and daily planning. Even if the problems and 
reservations regarding data protection and privacy are clearly highlighted issues in this 
scenario, in the end they will be put to one side due to the benefits electronic assistants 
bring to users. 

Between now and 2055, the state and private sector will have cooperated on devel- 
oping the required technologies. Key interventions include strong support of user-related 
information and communications technology (personal assistant systems, standardization 
of communication standards, and GPS) and technological development (encryption 
technology, sensors, position finding). One important prerequisite on the way is putting 
great effort into data security at the European level. 
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Mobility in this scenario’s target year is described as markedly networked. The authors 
outline a development in which mobility demand continues to rise. The strong emphasis 
on information and communication technology in this scenario will also further mobility’s 
automation, not least in optimizing traffic flows and reducing jams. In cities, mass taxi 
systems will to a great extent replace standard public transportation. These will take over 
the job of efficiently carrying and picking up passengers in boarding zones. The vehicles 
used locally for this will operate in assigned districts, and users will call them up using 
their personal assistants. The network will compute the most efficient route, including 
picking up and dropping off other passengers, and calculate the price. This network, also 
known as a “swarm,” can process large volumes of data on the traffic situation and 
demand locations. The vehicles can adjust their route. Passengers can use any vehicle 
instead of having to wait for a certain line. 

Autonomous vehicles will travel long-distance on freeways on “guided lanes” that are 
specially reserved for autonomous vehicles, some of them also for overnight use. People 
will buy larger vehicles and drive longer distances. These vehicles will be equipped with 
an “on-board driverless unit,” which communicates with automated systems along free- 
ways and essential commuter routes. This produces convoys of automatically controlled 
vehicles travelling tightly together at high speed. 

The development of urban land use is described differently in this scenario. On the one 
hand, there will be highly condensed city centers; on the other, suburbs with lower 
densities will grow. While young people in particular will prefer to live in urban centers, a 
growing number of high-income households will decide to move to city peripheries or the 
country. Despite increasing distances to their jobs in the city center, they will be able to 
continue having intensive working lives, either by aid of telepresence—using 
ever-more-powerful communication instruments—or the convenient use of automated 
vehicles. At the same time, this population group, by living in suburbia, will feel they 
have the opportunity to recover from increasingly tiring and demanding working lives in 
the hypermobile world. 


11.2.3 The Endless City 


While the scenarios for regenerative and hypermobile cities highlight technological 
development as a motor for changes in city life, mobility and urban structures, this 
scenario paints a somewhat different picture [12]. 

The underlying assumptions here are that technological innovations are not taken up to 
any great extent, particularly due to the high cost of the necessary infrastructure. Tech- 
nological development does take place, but is mainly restricted to efficiency gains in 
specific areas (combustion engines, solar energy). The power of the state to steer devel- 
opment is seen as limited. Even a transformation in behavior, as sketched out in the 
developments above, will not be seen. 
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With regard to mobility and urban structure, this scenario’s authors envisage a model 
still clearly dominated by cars. Due to limitations in how much states can develop public 
transport systems, so-called informal paratransit services will continue to grow. The 
degree of networking with available provision will remain low. The potential for auton- 
omous driving systems is not discussed. Spatially, cities will exhibit low density and 
fragmented settlement structures. In this regard, the authors are extrapolating a trend that 
is currently observable globally [13]. 


11.2.4 Discussion 


The selection and analysis outlined above shows that, scenarios do partially discuss the 
possibility of a transport system that is changed, or capable of being changed, by auto- 
mated driving. Automated solutions are formulated in scenarios with a high penetration 
and interlinking of innovative communication and navigation technologies in particular 
(regenerative and hypermobile cities). Here, automated driving is expected to contribute to 
public transportation. The scenarios describe the use of stackable and programmable 
compact cars, for example, and a networked mass taxi system. Automated private vehicles 
are mentioned in the course of long-distance freeway travel. Table 11.1 summarizes the 
main characteristics of the different scenarios with respect to likely forms of autonomous 
driving, the implications on urban form and land use, and the main driving factors. 

Turning to the effects of automated driving on urban structures, the various scenarios 
first describe how it is bound up with an overall transformation in the general framework. 
The regenerative city scenario assumes an increasing density of population and functions 
in cities. Other scenarios (hypermobile and endless cities) presuppose a continuation of 
the suburbanization tendencies that can currently be seen around the world. These are 
viewed as the consequence of high-income househoulds’ individual preferences, or as 
being due to processes of pushing low-income households out of cities. The formation of 
so-called mobility hubs or nodes is described in various scenarios as a visible change in 
urban form resulting from a transport system with elements of automated driving. In the 
regenerative and intelligent city scenario, the idea of networking is rigorously carried over 
to urban space. Multi-modal transport hubs allow physical networking and simple 
transfers between modes, e.g. from (electric) car to public transport. The scenario goes one 
step further, in that it also assumes a change in other uses, stemming from the bundling of 
different mobility options. It describes city districts that are organized around mobility 
hubs and utilities, and in which automated vehicles are incorporated as part of the public 
transport fleet. Parking and its connection to urban space is also discussed in very different 
ways in almost all scenarios. The regenerative city scenario describes the drop in land 
consumption in conjunction with falling numbers of private cars and local parking-area 
management. In the intelligent city of the future, an interlinking of private-car use with 
public transport will have been achieved, and new park and ride areas will have emerged 
at mobility hubs. 
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Table 11.1 The scenarios in overview 


Scenario Form of autonomous Urban land use Driving factor 
driving 
Regenerative - Flexible, multimodal and - Formation of — Technological 
city networked public intermodal mobility development (in the 
transport system as the hubs energy system) 
backbone of urban — Reduction in land — Conscious and 
mobility consumption for urban responsible use of 
— semi-autonomous cars parking spaces due to resources 
(autopilot) on freeways new parking systems - Legislation and 
acceptance promotion by 
the state 
Hypermobile - Highly networked — City centers of high - Increasing acceptance of 
city (autonomous) mass taxi density information and 
systems — Growth of low-density communications 
— Autonomous cars on suburbs technology due to its 
freeways with high lifestyle and commercial 
transit volumes or along benefits 
commuter routes, on — Cooperation of state and 
reserved “guided lanes” private sector in 


developing the necessary 
ICT technologies 


Endless city — Predominantly — Suburban growth — Limited state power to 

car-dominated — General decline of steer development 

— Low level of networking settlement densities | — Technological 
with public transport development restricted to 
(high proportion of efficiency gains in 
informal “paratransit” discrete areas 
provision) 

— No notable 


developments in 
automated driving 


Author’s own description, based on [7-12] 


The descriptions of intelligent and regenerative cities in particular are thus characterized 
by a basic conviction that technology will overcome existing and foreseeable problems 
(scarce resources, environmental change). The central significance of technological 
development is also confirmed in the endless city scenario, but from the opposite point of 
view. There, lack of innovation is interpreted as explaining a series of negative develop- 
ments. In a certain sense, this scenario depicts possible developments in southern cities of 
the globe, where the capacity of the state to direct development is comparatively low. 

Only the hypermobile city scenario critically deals with the topic of data. Problems of 
data protection and security are taken to be accepted in the target period of 2055, as the 
individual benefits of information and communications solutions for participation in social 
networks and working life outweigh the disadvantages in the eyes of the population. 


11 Autonomous Driving and Urban Land Use 221 


11.3 Autonomous Driving and Its Impact on Urban Structure 


The scenarios described in the previous section propose answers to the question: In what 
form is automated driving conceivably a feature of tomorrow’s cities’ transport systems? 
We will now have a closer look at the possible changes in urban form and land use 
resulting from this: How will the distribution of uses, density, and layout of urban spaces 
change under the influence of autonomous driving? 

The scenarios introduced above demonstrate that fundamentally different options can 
be imagined. Firstly, they describe the development of autonomous private vehicles that, 
depending on the scenario, are controlled with no external aids by an autopilot system or 
are integrated into the traffic flow via vehicle-infrastructure communication. Secondly, the 
scenarios envisage autonomous driving as an integrated part of public transport provision. 
It can be assumed that the effects on urban form could differ greatly depending on the 
form of autonomous transport system. In the following, therefore, both forms are con- 
sidered separately. 


11.3.1 Autonomous Private Cars 


At its core, this form describes the transfer of driving tasks to machines in uni-modal 
individual transport. It calls on aspects of the use cases, outlined in Chap. 2, of freeway 
pilot, fully automated with extended availability through driver, and valet parking. 

This case assumes that future use will largely correspond with today’s car usage. Apart 
from the changed properties of the technology used, no changes are expected. Cars will 
still be in individual ownership. No assumptions are made concerning changes in modal 
and destination choice patterns. There are, however, changes regarding current vehicle 
use. First, autonomous driving permits other activities during the trip: Former drivers will, 
for example, be able to work on their laptops, eat, read a book, watch a film or call friends 
[14]. Second, autonomous driving will change access and egress. Today’s cars are either 
driven directly from home to the destination, or the user has to walk to the parking 
location of the vehicle at the start of the trip and again from the parking to the final 
destination. One impact of autonomous driving, however, will be that these distances 
before and after the main journey will be made by the car, not the driver. The driving 
robot will maneuver the car from its original parking space to the location of the 
owner/user and, after arriving at the destination, to an allocated parking space. 

The possible effects and changes on urban structure from autonomous-vehicle usage 
include, firstly, the parking area needed for vehicles at home and destination. Secondly, 
locations would become more attractive for households choosing places to live. There will 
also be a transformation in the attractiveness of locations that are destinations for daily 
activities, such as shopping and leisure. This is accompanied by changes in the space 
required for flowing traffic resulting from autonomous car use. These three aspects will in 
the following section be looked at more closely. 
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11.3.1.1 Change in the Required Parking Area 

Overall, the expected changes in the area required for home parking are small, although 
they differ according to type of settlement structure. In residential neighborhoods of 
single-family houses, where parking spaces are on the same plot as the home, no changes 
are expected. The available parking space will simply be occupied by a different 
(autonomous) vehicle. In areas of higher density, such as inner-city districts, it may be 
assumed that neighborhood parking zones or collective garages will appear or be 
developed, as only in this way will autonomous vehicles be guaranteed to find a space in 
the neighborhood-defined catchment area. 

Further effects of autonomous driving on parking areas are possible at journey desti- 
nations away from home. This includes trips made for shopping, leisure and work. An 
autonomous vehicle would be able to drop off its passengers at their destination and then 
independently park itself in an allocated parking space or a collective garage. It is also 
assumed here that sufficient parking capacity will be provided to allow vehicles to find a 
space safely and reliably. On the one hand, this use of autonomous driving, where the 
vehicle drops the user off at the destination and proceeds to park autonomously, may be 
accompanied by greater user willingness to visit certain destinations by car. Equally, there 
may be a substantial impact on the provision and management of parking areas. Partic- 
ularly in areas of high-usage density, it may be assumed that a bundling of parking 
provision, in the form of collective garages, will follow. 

The possibility of saving space is named as an essential argument for the use of 
automated parking systems. These should be made more space-efficient, primarily by 
replacing ramps and aisles with lift shafts, and lowering storey heights, but also by 
increasing parking density [14, 15]. The developers reckon on up to 60 % more parking 
spaces on the same area by using parking robots [16]. 

The efficient use of space for parking is especially attractive in terms of costs [16-18]. 
Parking spaces required for building developments consume a lot of space and represent a 
considerable share of the costs of the whole investment, particularly when the garage to be 
built is not at ground level. There have already been some projects testing parking in 
garages with autonomous vehicles [19, 20]. The driver hands the vehicle over at the 
garage entrance. The parking function is activated with a smartphone app. The car 
receives the route data to the nearest available space from a central garage computer via 
WLAN and drives to it autonomously. An automatic parking system already in existence 
may serve as an example. All necessary vehicle movements, except for entry and exit into 
a handover booth, are carried out automatically (via conveyors and shifting equipment) or 
with a specially developed parking robot, as is already in use [16]. 

As mentioned above, the restructuring and possible concentration of parking areas 
might not take place everywhere. It will primarily be restricted to areas which are espe- 
cially attractive destinations, and where costs for building the required parking lots, and 
therefore also the attractiveness of space-saving solutions, are particularly high (the high 
price and scarcity of land resulting in multi-level solutions). High-density city center 
service and shopping zones count among these areas, as do new business districts with a 
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high number of workers. To this may be added mobility hubs such as airports and railroad 
stations, where, on top of the criteria just given, safe and secure solutions for long-term 
parking are sought. The extent to which the costs of parking might change in the course of 
autonomous driving cannot be estimated. On the one hand, dropping off passengers at the 
destination and subsequently parking elsewhere in the city (with less pressure on use and 
therefore cheaper) may save money [21, 22]. On the other hand, retrofitting and 
restructuring parking facilities and infrastructure brings with it its own costs. 


11.3.1.2 Change in the Attractiveness of (Residential) Locations 

Some studies point to an increasing attractiveness of suburban residential districts when 
autonomous driving becomes available [2, 22, 23]. According to this argument, house- 
holds using an autonomous vehicle may choose to live in green areas with lower house 
prices, but further from the city center, as the autonomous vehicle will compensate for the 
location’s downsides (longer distances). One consequence may be that new residential 
areas of relatively low density spring up, similar to the development of suburbanization in 
the second half of the last century. That was strongly driven by motorization, infras- 
tructure, a planning policy approach of separated uses and dispersed cities, and house- 
holds deciding to settle in the countryside. The results are still to be seen in today’s land 
use patterns [24]. 

In general, it is known that working people’s choice of where to live is far more 
influenced by factors such as quality of life and living environment than the wish to be 
near to their place of work [25]. This is backed up by a relatively high prominence of 
commuting to work. Some 60 % of all employees subject to social insurance in Germany, 
that is around 17 million people, do not work in the municipality in which they live. In 
order to get to work, working people spend on average around half an hour each way. Car 
use dominates here, being used to make 66 % of trips [26], in the USA as many as 86 % 
[27]. Based on datasets covering employment and occupation, as well working across 
regional borders, Guth et al. [25] discovered that the proportion of commuting beyond the 
home municipality, and distances covered, have grown in German areas of agglomeration 
in the last decades. 

Autonomous driving could further encourage this trend and the willingness to accept 
longer commutes. First, it is assumed that an increase in travel comfort will accompany 
autonomous driving (e.g. [14]). The travel time will no longer have to be taken up paying 
attention to the onerous task of driving, but will instead permit other activities. Mobility 
will not necessarily be seen as an unpleasant obligation or loss of time. Moreover, travel 
times may get shorter. In connection with autonomous driving, there are high expectations 
for a generally more efficient handling of flowing and stationary traffic [2, 22, 28]. 
Autonomous vehicle can harmonise their driving with each other, for instance when 
accelerating or braking, thus reducing journey times. Close to zero waiting at junctions is 
also forecast [14]. Clear time gains will also come when looking for parking spaces, as 
passengers are set down first. Overall, a journey with an autonomous vehicle will be easier 
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to predict and plan and be more reliable in terms of time. This is the result of almost 
constant speeds and a reliable and predictable routing from starting point to destination. 

Improved travel comfort and shorter and more reliable travel times are relevant factors 
for households weighing up further-away jobs, or other objectives such as good schools, 
against other location criteria such as local house prices or the attractiveness of a country 
location. The basis for decision-making could change, especially for working commuters 
with an autonomous vehicle. Journey times are a particularly large additional burden for 
commuters [29]. This is further exacerbated where it becomes impossible to calculate 
durations, and thus the time of arrival at the destination. Psychological studies for Greater 
London [30] show that time losses that the transport user cannot control—in traffic jams, 
for instance—are responsible for stress to a particularly large degree. 


11.3.1.3 Space Requirements for Flowing Traffic 

The benefits of autonomous driving mentioned above also lead to expectations that 
capacity on transport routes will be freed up. Coordinated acceleration and braking, and 
the higher vehicle frequency (the so-called “platooning”) will make possible a reduction 
of the street area used for traffic [30]. A substantially higher vehicle density in relation to 
road area is to be expected [30, 31], although forecasts for the extent of this increase in 
capacity differ. Fernandez [31], for instance, assumes up to 500 %. Brownell estimates 
over 250 % for highways and some 180 % for inner-city streets [32]. This means that the 
area required for flowing traffic could be reduced, by reducing the number of traffic lanes, 
for example. Lane width could also be cut in comparison to the present size, due to the 
altered driving behavior of autonomous vehicles (see Chap. 16). The reduction in the 
space needed for flowing traffic could allow other uses to be encouraged, such as cycle 
lanes and footpaths. Various authors, however, indicate that such effects only come into 
play with full automation [22]. 

Higher density of flowing traffic could also have an impact on transport users such as 
pedestrians and cyclists in other ways. Segregation effects may increase, for example, and 
crossing the street with densely flowing traffic may be made more difficult. In order to 
guarantee the benefits of autonomous driving for traffic flow while simultaneously 
maintaining its “permeability” for pedestrians and cyclists, the installation of 
intersection-free crossings such as under and overpasses would be a necessary 
consequence. 


11.3.2 Autonomous Taxis as an Integrated Part of Public Transport 


A second development, far more prominently discussed in the scenarios in question, is the 
emergence of a new model of urban mobility, in the form of autonomous taxi fleets. This 
touches on aspects of the “Vehicle on Demand” use case as described in Chap. 2. In such 
a system, low-cost autonomous taxis do not operate on fixed routes following rigid 
timetables, but rather in a demand-oriented and flexible way. They are in permanent 


11 Autonomous Driving and Urban Land Use 225 


operation and run in a city-wide, dense network of stations. This mode of operation is 
similar to hailed shared taxis. The city is divided into cells. A “central transit point,” or 
a series of them, for pick up and drop off belongs to each of these cells. It should be 
possible to integrate and combine taxis with rail-bound public transport. The taxis will 
take over feeder and dispersion functions to and from rail-based public transport stations 
and pick up passengers there, while the more efficient and potentially faster public 
transport takes over for longer route sections. The use of an automated taxi network has 
already been described and modeled as a concept [32-34]. It could lead to a fundamental 
transformation of public transportation and solve the problem that high-speed rail has 
covering the last mile [23]. It involves abolishing standard bus and tram stops. It is 
important that the system is an integrated one. It is an open question whether taxis will be 
operated by the public or private sector. 


11.3.2.1 Public Space Used for Transport and Parking 

The effects of a public transport system with autonomous vehicles on urban land use could 
be very extensive. The use of autonomous vehicles could cut down the number of parking 
spaces in city centers considerably, as the vehicle would not have to navigate to a parking 
station some distance away, but would simply drive to the next passenger. Vehicles would 
thus be in continuous service. Demand for parking spaces would fall. It would, though, be 
necessary to set up local depots for the cleaning, maintenance, refueling/charging and 
repairs of vehicles in service. 

Permanently available deployment of such taxi fleets may strengthen carsharing, and 
possibly dynamic “ridesharing” as well, as it allows the spontaneous renting of a vehicle, 
calculated to precise minutes and distances, for door-to-door journeys [14]. It could be 
viewed as a logical extension of currently available flexible car-sharing business models, 
which already have these properties (Car2Go, City Car Club, DriveNow, Zipcar). In this 
light, it may be assumed that such a system would noticeably alter vehicle ownership and 
usage (see Chap. 9). An increased degree of occupancy in car usage is also possible [22]. 

One consequence that may be assumed is a drop in car ownership among households 
living in areas with such a mobility-on-demand service in operation. Americans, for 
instance, could currently imagine getting rid of their second car, given the availability of 
such a system with direct pick-up from the front door [28]. The change in car ownership 
would lead to a change in the parking space needed for stationary traffic. This may go as 
far as stationary traffic largely disappearing in favor of areas for multi-functional trips. 
These areas could be wider than before and be divided into lanes for bicycles and elec- 
trically aided micro-vehicles with speeds of up to around 30 km/h, with a further lane for 
heavier and faster vehicles. 

A further change in the use of urban space is the establishment of pick-up and drop-off 
stations, which will further enhance the character of mobility hubs, especially those with 
transfer points to other forms of public transport. Beyond the reshaping of these spaces 
(stopping/short-term parking, picking up of passengers), changes in usage can also be 
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expected, such as a greater concentration of “traditional” shopping and service facilities at 
the hubs. 

Through the extensive reshaping of the public transport system, an impact on the 
complementary public transport infrastructure and uses is also possible. If users convert 
from using private cars to autonomous taxis linked up to an efficient rail-based network, 
forming the “backbone” of the system, passenger numbers would increase on these routes 
and, in all probability, capacities would have to be adjusted. 


11.4 Essential Driving Forces for the Development of an Urban 
Transport System with Automated Vehicles 


The previous Sects. 11.2 and 11.3 analyzed the scenarios in question and, based on the 
different characteristics, discussed the impact of a transport system influenced by auton- 
omous driving on urban land use. Following this up, this section asks which factors could 
have the greatest impact on the development of this type of system. 

The discussion of the scenarios firstly shows the great importance of technological 
innovation, where autonomous driving obtains an increasing role in the transport system. 
Progress and new developments in the area of information and communication technol- 
ogy, electronic and digital infrastructure, data management, and artificial intelligence are 
essential drivers of this trend, whereby a transport mode’s automation can be viewed as 
part of a more extensive automation of urban processes in general. The automation of 
parking, or of energy and facility management, are examples of this. 

As a result, we can see the high expectations for the state’s capacity to control events 
that are bound up with the development of transport systems involving automated vehicles. 
The scenarios expect that the state will cooperate with the private sector in developing the 
necessary technologies. This is accompanied by new legislation on licensing, insurance and 
liability, and acceptance-creating concepts on the topics of data management and stan- 
dardization (open source, interface compatibility, data protection and security). 

With regard to the population’s acceptance of autonomous driving, it is clear that a 
series of possible factors could have a positive impact. Firstly, automated driving is 
combined with societal use of an efficient and environmentally friendly transport system. 
Secondly, it is quite possible that private users’ and economic players’ acceptance will rise 
in coming years, due to individual lifestyle and economic benefits, particularly when 
governments actively promote technology and acceptance. 

A further factor that automation may positively impact is the prospect of cost-effective 
use and an upgrading of urban land use. One example is parking, for which automation 
promises clear cost-savings for the building of parking areas and, due to reduced space 
requirements, potential conversion to high-value usage. But areas on the edge of the city 
or in the surrounding area might also profit in the course of a potential revaluation of 
location-choice criteria, and from increased attractiveness as a place to live. 
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It must, however, be borne in mind that there is much uncertainty concerning the 
factors mentioned here. Firstly, given the fundamental legal and ethical questions (see 
Chaps. 4 and 25), it is not at all possible to predict at what speed, and in what form, urban 
transport systems involving autonomous vehicles will be developed. 

It is also currently not possible to reliably forecast the consequences for transport, and 
thus also urban land use. By integrating autonomous driving into a collective public 
transport system, carsharing may develop more strongly, and car ownership may fall. An 
increased acceptance and use of “one’s own” car could strengthen the prospects of 
individual motorized transport. The latter case, in particular, raises the question of possible 
“rebound effects.” Time savings and low usage costs may lead to higher mobility rates and 
increased kilometers traveled [22]. Under these circumstances, an increase in autonomous 
vehicles would compensate initial efficiency gains in the use of road capacity. 

However, the question of how the amount of additional costs of autonomous-vehicle 
use might evolve currently remains unanswered. The scenarios analyzed in this chapter 
are not plausible on this point, arguing solely on the assumption that mobility will con- 
tinue to be affordable in future. Calculations of the additional costs to equip cars, however, 
assume that both purchase and running costs will initially increase markedly [22, 28]. To 
these can be added resulting costs for municipalities for transport infrastructure adjustment 
and the building of new neighborhoods, should the attractiveness of suburbs actually 
increase. 

Out of all these aspects follows much uncertainty in planning for local and regional 
stakeholders—the politicians, administrations, transport operators and the real estate sec- 
tor. In particular, the adjustment of transport infrastructure and settlement development 
demands a long-term approach, including the corresponding regulation and financing. 
Changes in urban land use in the course of autonomous driving are thus only to be expected 
when most vehicles on the street are automated. So long as this is not the case, traffic 
density might well continue to increase significantly, journeys remain difficult to plan, 
parking demand stay high and street widths remain unaffected. Stakeholders, at least those 
from local traffic and urban planning departments, are thus currently still lacking important 
orientation for taking action and decisions. Not least among this is the lack of clarity as to 
what form autonomous driving will actually take in the medium and long term. 


11.5 Summary and Outlook 


The core aim of this article has been to fathom potential implications on urban form and 
land use of a transport system with autonomous vehicles, and to assess the way in which 
political and economic conditions might impact this development. Based on available 
scenarios and visions of “the city of tomorrow,” and their ideas regarding integrating 
autonomous vehicles into transport systems, we have seen that different developments can 
be envisaged. For example, is the autonomous vehicle in the scenario a private one driven 


228 D. Heinrichs 


by an autopilot, unaided by any external system, or is it networked via 
vehicle-infrastructure communication? Or is it an integrated part of public transportation? 

Depending on these varying characteristics, autonomous transport modes have the 
potential to change the transport system in utterly different ways. Their properties and 
potential uses will also affect land-use and urban planning. Areas of influence include 
parking demand and organization, and the attractiveness of neighborhoods as places to 
live, shop or work. Moreover, autonomous vehicles may allow land currently used for 
transport and parking to be converted to other uses (either for other transport uses, such as 
walking or cycling, but also for construction purposes). The changes that might actually 
follow depend largely on the direction in which autonomous driving evolves. 

What aspects are essential to include in discussions on automated driving from an 
urban development and planning point of view? 

Firstly, it is clear that autonomous driving may have a series of possible effects on 
urban land use that are relevant, in turn, as decision-making criteria for owning and using 
autonomous vehicles. The possibility of households achieving their “suburban” prefer- 
ences more easily is one example of this. Connections in decision-making processes 
between long-term mobility (location choice) and daily mobility (destination and transport 
mode selection) should be brought into debates surrounding autonomous driving. As well 
as such individual-centered criteria, there are relevant issues in relation to autonomous 
driving’s societal use. These involve, for example, the follow-up costs of developing new 
suburban neighborhoods as a result of changes in such areas’ attractiveness. The extent to 
which such correlations actually materialize as autonomous driving is introduced, and 
how the consequences are to be assessed, should be understood and discussed in relation 
to autonomous driving as a matter of priority. 

Secondly, there is the finding that, alongside potential changes in land use, far-reaching 
transformation—right down to new infrastructure and the reconfiguring of transport 
spaces including those for parking—may arise in the course of modifying the transport 
system. Developments in the driving patterns and handling of autonomous and 
non-autonomous vehicles, and also in other modes, must take this into account. That is 
altogether a long-term task, as changes in urban land use in the course of autonomous 
driving can only be expected when most vehicles on the street are automated [22]. Many 
of these questions need further investigation. There is, for instance, a need to analyze what 
impact autonomous driving might have on long-term plans for designing parking spaces, 
cycle lanes, junctions, sidewalks, cross-sectional road profiles etc of urban spaces. How 
can a successive transformation towards a transport system with autonomous vehicles be 
designed? What are plausible scenarios for its introduction in the first place? Requiring 
clarification here is not merely how the present infrastructure can be “converted,” but also 
how the current prioritization and roles of various modes and transport means will change 
in the process. With the increase in autonomous vehicles and the emergence of special 
traffic lanes described above, there may be greater separation of functions between various 
modes. It may also become more difficult for other transport users to cross the street as a 
result of autonomous vehicles’ dense traffic flow. This raises the question of on how much 


11 Autonomous Driving and Urban Land Use 229 


of an equal footing, the mix of the various transport-mode uses should be managed in 
future, as the impact of autonomous driving makes itself felt. 

It is becoming clear that not only are urban development issues relevant to the debates 
on autonomous driving, but the reverse is also the case. Of great consequence is the 
impact that an automated transport system has on the concepts and objectives of urban 
planning and development. To what extent and under which conditions can a transport 
system with autonomous vehicles contribute to realizing currently valid models, such as 
dense and compact cities? Or will automation promote a return to cities built around the 
automobile? What is the relationship between urban-planning elements for structuring 
autonomous transport and the demands of the universally aspired-to city of pedestrians, 
cycling and rail? Could it be, under the impact of autonomous driving, that we need to 
formulate fundamentally different or new models for the development of cities? We can 
now start the discussion of these questions. 
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Automated Vehicles and Automated 1 2 
Driving from a Demand Modeling 
Perspective 


Rita Cyganski 


12.1 Motivation and Aims 


In 2013 Willumsen, one of the most renowned researchers in transport modeling, stated, 
regarding automated vehicles: “We can no longer ignore them, if [the] planning horizon is 
10+ years” [37]. But works attempting to anticipate the effects of automated vehicles on 
potential users’ everyday mobility, and specifically their choice of transport mode, are still 
rare (e.g. [11, 19, 37]). However, a glance at the individual driving forces of our daily 
mobility behavior does allow us to draw some cautious conclusions on potential behav- 
ioral changes arising from the introduction of automated vehicles. Applying analogies to 
the use of known transport modes in transport demand modeling allows for initial 
quantitative statements about potential impacts on overall transport demand. In the pro- 
cess, demand modeling allows us to distinguish between different geographic contexts and 
user groups, and to evaluate various scenarios for the use of such systems. 

The aim of this chapter is to sketch out challenges and initial approaches on how to 
incorporate automated vehicles among the choices of transport mode when modeling 
demand in passenger transport. First, we will examine which factors play a central role in 
the individual processes when weighing up the various transport modes. The following 
section gives a short introduction into transport demand modeling’s manner of operation. 
We shall then turn our attention to what behavioral changes may appear in transport modal 
choice as a result of introducing automated vehicles. We will discuss what properties of 
the new vehicles, and also of the geographic context and potential users themselves, could 
be significant in how the vehicles are perceived and received, and what competitive 
situation between transport modes this will result in. To support this work, we shall 
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introduce the initial results of an online questionnaire on attitudes to automated vehicles 
and their anticipated use. The concluding section addresses the following questions: What 
are the challenges when integrating automated vehicles into model-supported transport 
demand analysis? How do current models and data bases need to be expanded to give an 
adequate mapping? 


12.2 What Determines Which Transport Mode We Choose? 


The question as to why we decide in favor of a certain mode of transport occupies a 
multitude of publications from various disciplines. There is consensus that a vast number 
of complex interdependent factors underlie human transport behavior and mode choice. 
According to Bühler (2001), these subdivide into four groups: (1) socio-economic and 
demographic characteristics, (2) cultural frameworks and individual preferences, 
(3) spatial development patterns and (4) political regulation [6]. Alongside personal 
criteria, Ortüzar and Willumsen [24] see the characteristics of the intended journey and, 
not least, of the transport supply and of the modes available as being most decisive. 

Of special significance in mode choice is the question of access to alternative modes of 
transport. Driver’s license ownership, individual income situation and closely related car 
ownership are important behavioral determinants. Substantial investments such as 
purchasing a car or a season ticket for public transportation have a long-term impact on 
transport mode choice [31]. Clear differences in modal choice can be seen in terms of sex, 
employment status, and household size and structure. Further, the presence of children in a 
household has a particular influence [6, 24, 28]. But it is not only objectively measurable 
criteria that play a role. Individual personal circumstances, lifestyles, and attitudes towards 
the various transport modes and traveling itself affect the decision, as do daily habits and 
routines (see [25, 27, 29, 33]). The effect of transport socialization and social and envi- 
ronmental norms is stressed in the approaches of learning theory and cognitive and social 
psychology (see [2, 12, 27]). These show clearly that individual decisions often do not 
correspond to the idealized picture of an independently and rationally deciding human being. 

Residential location is considered to be the main spatial anchoring point for individual 
transport related decisions. Its physical structures directly affect the accessibility of des- 
tinations looked at visiting and the effort it takes to get to them ([6, 9, 27], Chap. 20). For 
instance, higher population density, greater mix of uses, and proximity of public trans- 
portation are associated with lifestyles with lower car use and higher rates of walking and 
cycling. At the same time, traffic jams, shortage of parking space, and higher parking costs 
are more common in densely populated areas [6]. 

If nothing else, the financial cost of using a transport mode is a direct or indirect 
consequence of political regulation. Operating costs, road tolls, and parking costs influ- 
ence how people view their cars. Travel time, particularly in comparison to the time 
needed for the alternative transport modes available, is another important selection cri- 
terion. In this context, it should be distinguished between time spent on pre- and 
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post-usage, e.g. the way to and from bus stops, and time actually spent travelling on the 
bus. In the case of public transport, moreover, it can be shown that waiting and transfer 
times, and the number of transfers, have a considerable impact on how the mode is 
evaluated Wardman [36]. However, it is not only instrumental factors that play a 
significant role, but also the associated symbolic and affective ones [33]. For instance, a 
transport mode’s alleged or actual reliability and punctuality affect the decision for or 
against a specific transport mode, as do its associated safety, convenience, pleasure, and 
flexibility [4, 24, 33]. 

Selecting a transport mode, furthermore, also depends on the purpose of the journey. 
Here, not only the individual trip but the whole trip chain, i.e. all journeys undertaken 
between leaving the home and returning to it, should be considered [4]. The number and 
type of accompanying persons can also be decisive in selecting a means of transport, as 
can transportation needs or the distance to be covered [16, 25, 33]. 


12.3 Transport Mode Choice in Applied Transport Models 
12.3.1 A Short Introduction to Transport Demand Modeling 


Transport demand models are important and established tools in transport-related planning 
and decision-making processes. They allow for analysis of the present transport situation, 
forecasting of future developments in transport demand, or the examination of various 
potential development paths based on scenarios. The basis of a transport demand model is 
the simplified, purpose-specific representation of interdependencies between mobility 
demand and its concrete geographic manifestation. Transport models are mathematical 
models that place high demands on the extent and depth of detail of the input data, and 
which, particularly in relation to human decision-making processes and present transport 
demand, rely on extensive empirical data. 

The aim of passenger transport modeling is to represent all decisions of individuals 
made as a consequence of a planned change of location. The first model stage, trip 
generation, addresses the question of how many changes of location are made in the study 
area. To this end, the number of trips or activities that can be expected for the population 
according to statistics within one day is determined. In the process, the generated trips or 
trip chains are differentiated according to trip purpose. In the next step—destination 
choice or trip distribution—a destination is selected for each trip depending on its pur- 
pose. Given the combination of origin and destination, the third model step—transport 
mode choice or transport allocation—weighs up the various available transport modes 
and selects one of them. The next step—traffic assignment or route choice—determines 
the route taken from origin to destination and sometimes specifies the starting time in 
more detail. The basis here is the so-called supply model, in which the transport system 
for all available transport modes is mapped in such detail that the attributes for each 
potential route—such as travel times between two locations—can be determined. As a 
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result, a transport demand model provides information on the location changes of the 
study area’s population and the resultant traffic volumes for individual modes of transport. 
In practice, the individual stages of the model, presented here for the sake of simplicity as 
a sequential process, often find simultaneous or recursive application—choice of transport 
mode and destination are combined particularly often. For a more in-depth look at 
transport demand modeling, see [5, 24]. 

As a tule, transport demand models can be divided into microscopic and macroscopic 
model approaches. These approaches differ both in view of the information and properties 
required and the model logic in mapping decision interrelationships. Macroscopic demand 
models, also often called Four-Step Models or FSM, directly reflect the four stages 
mentioned above. Based on its socio-demographic, transport-related characteristics, the 
population in the study area is subdivided into groups so that behavior within a group is as 
similar as possible while deviating significantly in comparison to the other groups. 
Classifications are typically based on sex, age, employment status, and car owner- 
ship. Usually, household context is not considered (for more details, see [18], inter alia). 
In the course of modeling, all trips generated by group members are modeled collectively 
and independently from other changes of location during the day in question. For further 
description of macroscopic models, see [5, 22]. 

Particularly in regional modeling in the USA, so-called activity-based or microscopic 
modeling approaches to transport demand have grown in significance in recent years. 
Compared to macroscopic models, these are more greatly focused on people’s individual 
mobility decisions and consider a person’s detailed characteristics and household context 
to a greater extent. A day’s individual trips are modeled jointly as tours starting and 
ending at home. This form of representation allows for consideration of behavioral 
interdependencies between individual activities and decisions. In the course of 
microsimulation, the trip chains of all persons in the study area are calculated individually, 
yielding an overall picture of transport demand. In-depth information on activity-based 
modeling approaches can be found in [7, 10, 21]. 


12.3.2 Decision-Making Criteria in Applied Models of Transport 
Mode Choice 


Transport mode choice is of great significance in demand modeling, with its results being 
highly relevant for planning and policy [24]. Generally, discrete choice models or closely 
related methods that presuppose strongly rational decision-making behavior are 
employed. These statistical models help to identify the respective influencing factors and 
the extent of their impact on decision-making. If one assumes that the total utility of a 
choice alternative can be derived additively from the individual components, then benefit 
of choosing an option can be calculated and compared with other available alternatives. 
The probability of selecting one variant increases with its relative advantages compared to 
other options [20, 24]. The specified models can differ in their complexity (see [34], 
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for example). Transport mode choice models that are integrated into demand models, 
however, usually only consider a few variables covering the characteristics of the transport 
mode, the people, the trips, and the geographic structure. 

In describing the available transport modes, the financial and temporal costs of a choice 
assume prime importance. In the case of cars it is primarily running costs that are con- 
sidered, purchase and maintenance costs more rarely. Time costs are primarily taken to be 
average onboard travel times. Less frequently, and then mainly for public transport, is 
time spent getting to and from the bus or train included. In the latter case, the number of 
transfers, waiting and transfer times, or even service frequencies are often also taken into 
consideration. Elements such as the reliability of the travel time have until now mainly 
been found in analytical models [4]. By using a transport mode specific constant, 
moreover, utility components that cannot be further specified may be considered in 
aggregate. Age, sex, income statues, driver’s license and car possession are among the 
typical socio-demographic attributes in the models. Income variables, level of education, 
and household size or number of children are rarer. In particular for socio-demographic 
characteristics, it is common to interrelate with other attributes when determining their 
utility components, thus allowing different levels of influence for specific groups of 
people. Assessing transport modes may also depend on the trip purpose; interaction terms 
specific to the trip purpose are thus also not uncommon. Distinguishing journeys to work 
is particularly important here. But also the need to transport items, or commonly having 
accompanying passengers for specific trip purposes, such as shopping or longer travelling, 
may require corresponding differentiation. Geographic and contextual characteristics form 
a further area. Official geographic typification, or population density at the residential 
location, e.g., can be used to differentiate between rural and densely populated areas. 
Factors describing the parking situation, parking costs or possible toll areas can also be 
found in some models. 

Transport demand models are strongly data-driven and presuppose that quantitative 
statements on interdependencies can be made. In the absence of sufficient data, numerous 
factors known to be relevant for transport mode choice can often only be included in 
models in simplified form. This particularly affects so-called “soft factors” such as 
routines, transport modes’ perceived comfort and reliability, the pleasure associated with 
traveling by such means, the social standing conveyed, individual safety requirements, 
and propensity for privacy. It is not only attitudinal factors, however, that are examples of 
issues that, despite their known relevance, have hitherto hardly been considered in 
transport demand modeling, but also knowledge of alternatives, the potential effort needed 
to plan, and also the way in which households come to collective decisions (see [35], 
among others). 

Mapping new transport modes poses a particular challenge, moreover. The liberaliza- 
tion of long-distance bus services in Germany, the introduction of station-based carsharing 
services, or even the introduction of electric cars onto the market are examples of modi- 
fications of existing transport provisions where forecasting usage patterns has proved to be 
difficult and reliable figures on interdependencies are lacking. But even differentiating 
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between the various current modes using “hard” factors is not always easy. Transport 
models have historically mainly been employed to calculate the vehicle miles travelled. As 
recently as 2012, Bates showed that four-stage models contained barely more than one 
distinction between “private modes,” i.e. car usage, and “public modes”. These have only 
recently been extended to include other aspects, such as distinctions between driver and 
passenger [5]. Distinguishing among cars, for example according to size or type of drive, 
has only latterly been introduced in modeling. This all amounts to a series of significant 
challenges when integrating automated vehicles into the analysis. Ultimately, it is a matter 
of examining “the car” more closely and enabling clear differentiation between driving and 
being driven, a car you own and a car you hire, or a taxi, even. 


12.4 What Impact Might the Roll Out of Automated Vehicles 
Have on Our Behavior in Choosing Transport Modes? 


Before examining the question of how automated vehicles can be looked at in transport 
modeling, it must be explained how the introduction of these systems might affect 
individual daily mobility. In general, the potential use of automated vehicles, or also of 
new mobility options, greatly depends on their possible applications and the advantages 
they offer compared to other modes on offer—that is to say, on factors relevant to how 
automated vehicles are judged compared to other modes when choosing transport modes. 
Such factors should then, as far as possible, be included in models. For the use cases 
described mostly in technical or legal terms in Chap. 2, I will therefore begin with a 
discussion of possible usage variants. Central issues requiring further examination here 
include: how to typify the expected users, the trip purposes and intended uses for which 
corresponding systems are particularly suited, the geographic or contextual characteristics 
that make it necessary to use public transport, the relevant transport mode characteristics 
and the transport mode substitution that may result from this. The discussion is hereby 
focused on characteristics suitable for depiction in transport models. 


12.4.1 Interstate Pilot: The Car with that Special Something 
for Exceptional Circumstances? 


Interstate Pilot may come to be the entry level for automation, as the driving task remains 
except in exceptional circumstances. The two main aspects of Interstate Pilot from a user 
perspective are easing the driver’s workload and the possibility of spending travelling 
time in other ways. 

The use of Interstate Pilot will only be possible on specific stretches of road, and thus 
mainly on long-distance trips. For this reason, it may be assumed that this system would 
mainly positively impact how cars are perceived and assessed in the case of longer 
journeys. In addition, Continental’s user survey clearly shows that handing over the 
driving task is positively connoted, especially in stressful or tiresome situations such as 
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traffic jams or roadworks [8]. It is also not uncommon, however, to associate such a 
handover with restricting the pleasure of driving [1]. 

After increased road safety, the possibility of an altered use of time, mostly associated 
with increased meaningfulness or productivity, is arguably the most-mentioned advantage 
of automated vehicles (see [23, 26, 30, 32], for example). For working people and those 
with great private commitments in particular, and for trips with children or with other 
passengers, this could lead to time spent travelling being viewed more positively—one of 
the most important factors for transport mode choice in models. In the end, this may lead to 
longer trips on public transportation being assessed relatively more negatively, particularly 
by people who use this time actively, and to cars being perceived as the more-comfortable 
alternative, leading to them gaining in popularity. The significance of the alternative time 
usage is, however, difficult to assess. In the Continental study, for example, only around a 
third of respondents stated that they found an alternative time use attractive [8]. 


12.4.2 Valet Parking—Never Look for a Parking Space Again? 


Valet Parking is a function in more or less “normal,” only slightly modified cars, where 
the driving task remains unchanged. The vehicle only takes over the task of parking and 
driving to pick its occupants up autonomously within a defined radius upon user request. 
According to a survey by AutoScout24, just under two thirds of respondents would 
happily use this function and never again search for a parking space themselves. Among 
residents of urban districts, this percentage is higher, as would be expected [1]: The 
function is mainly of benefit in areas with a low number of private parking spaces, where 
there is pressure on parking, and long distances from homes or destinations to their 
respective parking spaces (see also Chap. 20). It thus helps to save time and also parking 
costs, where applicable [19], and it provides greater convenience, particularly when 
transporting items or children, and for people with restricted personal mobility. Even if 
greater use of carsharing is discussed primarily in the case of Vehicle on Demand (see 
[11]), less time and effort spent getting to the car with Valet Parking may possibly ease the 
use of carsharing. Consequences that we can be surer of include a substantial drop in 
parking search traffic, and an accompanying fall in travel times in areas previously 
affected by this. 


12.4.3 Arriving Comfortably and Safely in a Fully Automated 
Vehicle 


Fully automated driving is the “créme de la créme of driver-assistance systems” [3]. 
Although the human driver will—at least provisionally—need to be in a position to take 
over the driving task, this should only be necessary when desired. Given sufficient rates of 
penetration, this driving concept is linked with a vision of safe, reliable personal mobility 
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and improved traffic flow leading to less time spent travelling and in jams, as well as 
making the planning of journey times and costs more predictable [3, 26, 30]. At the same 
time, it may be assumed that inhibitions regarding car usage and ownership will decrease, 
especially for users who are inexperienced, uncertain or older. The car would thus 
become, for instance, a more attractive option in unfavorable driving conditions such as 
darkness, unknown or longer routes, and in bad weather conditions (see also [11]). One 
consequence of this is a possible fall in the number of escorting trips and the use of taxis 
and public transport, and a corresponding increase in car ownership. 

The most frequently cited advantage from users’ point of view, however, is the 
associated hope—analogous to Interstate Pilot—of being “given time that I can use solely 
for me” [26]. It is therefore no surprise that this technology’s target group is mostly seen 
as being working commuters (see [17] for example)—fully automated driving provides, 
precisely in urban densely populated areas, meaningful use of time spent on-board. This 
benefit is likely to result in a more positive evaluation of the car, especially if time spent in 
cars was not previously perceived as productive, and pleasure in driving not a priority. We 
thus see it is particularly people who are not the most passionate drivers who most desire 
to use such a function [17]. 


12.4.4 Vehicle on Demand—Zipcar on Steroids? 


A scenario involving a fleet of vehicles that is in large part available and usable for 
everyone, particularly in urban areas, would undoubtedly have the most wide-ranging 
impact on daily transport behavior. A logical extension of fully automated vehicles, but 
with no option of taking over the driving function, it would allow for independent per- 
sonal mobility even for those without a driver’s license or their own car: children, the 
elderly, people who are sensory or mobility impaired, etc. (see [19], among others). 

In general, we can assume that cars will gain in attractiveness as access and egress 
times decreases, especially in areas with a parking-space shortage. Alongside the potential 
drop in parking costs from being able to park further away from the destination, a clear fall 
in the number of escorting trips may also be expected, as well as in the use of carpooling 
and taxi services—possibly accompanied by an increase in empty runs. 

At the same time, introducing Vehicle on Demand fleets is universally expected to lead 
to substantially lower rates of car ownership [19], [37], possibly accompanied by a boom 
in carsharing use. With reference to the US carsharing firm, Silberg et al. [30] have even 
spoken of “Zipcar on steroids”. It seems particularly plausible that two-car households 
might substitute their second vehicle, which—depending on the situation in terms of 
weather, parking availability, number of people travelling, ete.—would also allow a 
specific vehicle to be selected accordingly (see [17, 37]). 

Given Vehicle on Demand’s introduction, Fagnant and Kockelman [11] would expect 
a substantial impact on individual car ownership. According to their simulation calcula- 
tions for the USA, a single Vehicle on Demand could replace up to 13 private cars [11]. 
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Studies on station-based carsharing in Germany put the substitution rates at up to eight 
private cars replaced by a single carsharing vehicle [15]. Because Vehicles on Demand 
can cover a wider catchment area by abolishing the need for trips from the starting point to 
the vehicle, these figures do not appear unrealistic. A glance at carsharing’s current user 
structure provides the first clues as to the potential users of Vehicle on Demand. In 
particular, younger people of higher-than-average education and income with distinct 
interest in the environment use station-based carsharing in Germany. The fairly new 
carsharing services that are not tied to stations, also known as flexible carsharing, are 
mainly used by urban males as a flexible transport mode option for short trips (see [13, 
14]). The use of Vehicle on Demand as an alternative to privately-owned cars might thus 
directly lead to a boost in multimodal behavior in choosing transport modes, or contribute 
to an increase in carpooling (see [26]). However, given that time spent in the vehicle is 
often viewed positively, a rise in car use and mileage covered is also possible as a 
consequence of their omnipresent availability ([11, 37], Chap. 20). These new mobility 
concepts are examined in depth in Ch. 18. 

But it is not only individual car ownership that may be subject to extensive changes in 
such a scenario. Car services, taxis and public transport may find that competition with 
personal transport modes hots up anew. Especially in rural areas, Vehicle-on-Demand 
fleets could serve either as flexible, individual feeder services for local public transport, or 
as a way of comfortably covering the “last mile” for long-distance public services. Critical 
analyses, however, also allow for the theory that they would not simply supplement public 
mass transit, but in the long run could even replace it: “[...], eventually, mobility on 
demand may prove a better investment than new mass transit systems” [17], an assessment 
also shared by Willumsen [37]. In this case, assumptions that passenger kilometers 
covered on an individual basis may rise steeply surely cannot be rejected out-of-hand. 


12.4.5 The Car of the Future: Competition for Cars, Taxis or Trains? 


Reviewing the literature as it stands shows that introducing automated vehicles could have 
very diverse effects on our daily mobility and chosen means of transport. Automated 
driving thus is not always only a lightly modified version of our long-familiar cars that 
will improve traffic flow and travel times and provide support functions as desired, as 
suggested by a graphic in the KMPG study [17]. Rather, its potential effects differ 
enormously for existing private transport modes, and even public ones. The wide-ranging 
implications resulting from the various scenarios for the whole transport system and the 
use of public space generally are explored in depth in Chap. 20. The possible effects on 
transport mode choice, as seen in the literature above, clearly show that the characteristics 
relevant for perception and valuation of the vehicles in the various usage scenarios may be 
very different. These diverse requirements must be borne in mind when analyzing any 
potential mapping of automated vehicles in transport demand modeling. 
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12.5 What Potential Applications Do Users Anticipate 
for Automated Vehicles? Initial Survey Findings 


Quantitative studies on the topic of automated driving have been carried out sporadically 
since 2012 [1, 8, 17]. The surveys have largely focused on issues of attitudes and 
acceptance, or on desired support functions. With its questions on anticipated usage and 
alternative time use, Continental’s mobility study from 2013 [8] is noteworthy in this 
connection. However, all of the studies have in common that they do not consider any 
differentiation in the possible forms of automated driving, and are not targeted at possible 
behavioral changes or potential intended applications. 

For this reason, a survey was carried in June 2014 which provides the basis for the 
empirical findings of both this article and those on the form of the human—machine 
interface (Chap. 26) and the acceptance of automated vehicles (Chap. 28). This 
quasi-representative online survey addresses respondents’ attitudes and their anticipation 
of how they would use automated vehicles in the project’s various use cases. The sample 
comprises of 250 complete questionnaires per usage scenario (total 1000) and is stratified 
according to sex, age, income and education. Using quantitative methods, the dataset al- 
lows for an initial evaluation of various user groups’ attitudes to automated driving and 
mobility provision. This supplements the previous section’s findings. From a demand 
modeling perspective, the survey’s aim is mainly to comprehend what differentiations 
with respect to users, trip purposes, intended applications, and transport mode charac- 
teristics are relevant when modeling automated vehicles. Also, data analysis should 
provide the first indications of which transport modes, from today’s perspective, auto- 
mated vehicles would compete with for users, and of how time spent traveling may 
change, and how these changes are viewed. 

The questionnaire begins with questions covering the respondents’ 
socio-demographics, their knowledge of and interest in automated driving, and their 
previous experience of assistance systems. This is followed by questions on their current 
use of, and attitudes to, existing transport modes and the usual way they spend time when 
using them. The respondents also answer in-depth questions on one of the project use 
cases—Interstate Pilot, Automated Valet Parking, Full Automation and Vehicle on 
Demand (see Chap. 2). Topics include anticipated use, the transport mode that would be 
replaced, attitudes towards the vehicle described, the need to be able to intervene, various 
aspects of the experience, and specific design wishes. The scenarios are described fairly 
briefly to leave room for the respondents’ own interpretations. A tabular overview of the 
participants’ socio-demographic characteristics and the sample structure can be found in 
Chap. 26. 
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I can imagine replacing my previously preferred transport mode with 
such a vehicle. 


Vehicle on Demand | ifm” 
Fully automated vehicle III NEN O 
Vehicle with Valet Parking IIIs OO 
Automated vehicle with Interstate Pilot NINN O D 
In general: an automated vehicle EIN nn TT 
0% 10% 20% 30% 40% 50% 60% 70% 80% 90% 100% 
= Completely disagree m Mostly disagree Tend to disagree = Tend to agree m Mostly agree m Agree completely 


Fig. 12.1 Stated willingness to substitute favored transport mode with an automated vehicle 
generally and in the various use cases. Image rights: copyright by the Author 


12.5.1 Who Can Imagine Substituting Their Previously Preferred 
Transport Mode? 


To evaluate automated driving’s impact on transport mode choice, it is especially 
important to know what transport modes automated vehicles may replace. To this end, in 
one of its first questions, the survey enquires into participants’ basic willingness to sub- 
stitute their preferred transport mode with an automated vehicle—at this stage an undif- 
ferentiated one. As the questionnaire continues, the respondents are also asked, for one of 
the use cases, if they could imagine using the vehicle specified or substituting their 
preferred transport mode with it. The results were also examined as to whether significant 
differences could be seen in answers according to respondents’ socio-demographic 
characteristics and attitudes.’ Corresponding relevant statistical values can be se seen as 
indicators that, when integrating behavior into the models, it should be differentiated 
according to these criteria—the specific strengths or tendency of the effect is of secondary 
importance at first. 

Figure 12.1 gives the respective answers on substitution desires, which tend to cor- 
respond to the general willingness to use automated vehicles (see Chap. 27). It is striking 
that the majority of respondents can either hardly imagine, or cannot imagine at all, giving 
an automated vehicle preference over their standard transport mode. Fewer than 15 % of 
respondents agree with the statement of wanting to use an automated vehicle—no matter 
what kind—predominantly or as a full replacement. While the proportion of undecideds is 
very high for the general statement, the agreement value falls sharply for the specific 
scenarios, between which there is statistically significant variation. With only around a 
quarter of positive answers, the Vehicle on Demand use case stands out here as being 
regarded with especial skepticism. Full Automation, on the other hand, is viewed most 
positively on average. 


Hn the following, differences are indicated as statistically significant when exhibiting values of 0.05 
or lower in a Pearson’s chi-squared test. For some variables, particularly attitudinal or geographic 
ones, a test was not always possible, due to the number of cases in individual answer categories. 
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A differentiated analysis of the desire to switch modes can reveal statistically highly 
significant differences in terms of household size, presence of children, income, and the 
number of cars in a household. The most clearly discriminatory factor, however, is atti- 
tudes towards cars. These are revealed in questions on what people associate with car 
driving and whether they take pleasure in it, and also whether respondents could set up 
their daily lives without a car. Residential location also produces clear differences in the 
answers. Rural dwellers, for example, are less skeptical in their answers than people in 
cities. Sex, levels of education and income, in contrast, do not have a statistically 
significant impact on the answers given, nor does shortage of parking at home or other 
main reference locations. Looking at the individual usage scenarios, it is notable that there 
is higher skepticism towards Vehicle on Demand among women, as well as marked 
differences in the answer patterns vis-a-vis Valet Parking, depending on the presence of 
children, household size, and income. 

The participants were also asked how, in their opinion, using an automated vehicle 
from one of the scenarios would affect their previous transport mode use. The answers 
were given separately for each previous transport mode and ranged from “far less often” 
(-2) to “far more often” (+2). The large percentage of those who assume no change in 
their behavior is also conspicuous here: With the exception of taxis and conventional cars, 
a number of respondents consistently between 50 and 64 % state they foresee no change in 
their transport mode use. The respective mean values of answers given for individually 
anticipated mode shift effects are shown in Table 12.1. A mean value of 0 is to be taken as 
indifference. Taxi use is estimated to fall in all scenarios. It is noticeable that Valet Parking 
produces the greatest associations of switching—particularly from taxi use, with its very 
low mean value of —0.78. 


Table 12.1 Effects of scenarios on previous transport mode use 


Scenario I would take a I would I would I would I would drive in 
public transport cycle or take the take a a conventional 
mode ... walk ... train ... taxi ... car... 

Interstate 0.36 —0.28 —0.35 —0.70 0.04 

pilot 

Valet —0.44 —0.28 —0.51 —0.78 —0.32 

parking 

Full —0.33 0.11 —0.41 —0.74 —0.23 

automation 

Vehicle on —0.33 —0.15 —0.35 —0.78 —0.13 

demand 


Mean values of answer options —2 far less often; —1 less often; 0 just as often; 1 more often; 2 far 
more often 
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12.5.2 What Do Respondents See as the Specific Advantage 
of Automated Vehicles? 


A further question asks for which intended applications and trip characteristics the 
respondents would find automated vehicles to be particularly helpful. The answers’ mean 
values are given in Table 12.2. With the exception of escorting trips, there are consistently 
highly significant differences between the scenarios. This indicates that the respondents 
may clearly differentiate between the scenarios. The comparatively high agreement values 
for Full Automation for long-distance trips and excursions are noteworthy, to a lesser 
extent for trips with higher occupancy rates. Valet Parking is viewed as particularly 
helpful in urban contexts and for transporting items. 

A differentiated analysis points out the fact that, for all trip purposes, male respondents 
have statistically significantly higher rates of agreement for Vehicle on Demand. This is 
also the case for work and long-distance trips using Interstate Pilot. We also see that 
education levels, as measured by university-entrance diploma, have a significant impact 
on attitudes to Vehicle on Demand for long-distance (cross-country) trips, excursions and 
escorting trips. The presence of children in the household has a significantly positive 
impact on how useful Full Automation is viewed for trips in the city as well as 
cross-country. No correlation was seen for escorting trips, however. On long-distance and 


Table 12.2 Respondents’ stated answers to the question: “On which trips would you find such a 
vehicle to be particularly helpful?” 


Interstate Valet Full Vehicle on 
pilot parking automation demand 
... when I drive to work or college -1.0 0.4 02 —0.6 
... when I go shopping or run Sle? 0.2 0.3 0.4 
errands 
... which I pick people up or drop 0.8 0.4 -0.1 0.5 
them off 
... when I go somewhere for 0.8 0.4 0.4 =07 
recreational activities 
... when I travel or go on excursions 0.1 -0.1 0.4 —0.2 
... when I’m on the road for a long 0.4 02 0.8 0.2 
time 
... when I am in company 0.4 0.4 0.0 0.4 
.. when I drive in the city Sel 0.5 -0.1 0.4 
.. when I drive cross-country —0.4 Aldo) 0.3 —0.3 
.. when I have luggage with me 0.9 0.3 0.4 0.5 


Mean values of answer options: —2 much more rarely; —1 more rarely; 0 as often; 1 more often; 2 
much more often 
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urban trips, the answers given for Valet Parking differ depending on household size and 
the presence of children. Employment status” almost exclusively determines differences in 
the answers for Valet Parking on long trips, journeys to work, and for leisure activities; the 
latter also being conditioned by income level. 


12.5.3 What Do We Do on the Road Today, and What Will We Do 
Tomorrow? 


The possibility of pursuing other activities during a journey is one of automated driving’s 
main features from a usage point of view. At the same time, time costs are a main driver of 
transport mode choice in models. To conclude, we shall therefore cast our eyes on the 
survey results regarding previous and also, perhaps, future time use. 

The respondents were first asked how they generally occupied themselves while 
travelling on (urban) public transport, on (long-distance) trains or in cars. By far the most 
mentioned activity on public transport was enjoying the landscape and the journey: 50 % 
of respondents stated doing this frequently or always on public transport, 66 % on trains. 
Conversation with a companion or other passengers is similarly popular (public transport: 
42 %, trains: 49 %), followed by listening to music, reading or relaxing. Around 77 and 
69 % of respondents stated they never work on local or long-distance journeys respec- 
tively; just under 6 and 8 % frequently or always. The answers on working while on the 
move differ for train travel to statistically significant degrees according to sex, income, 
level of education, household size, and the presence of children. For example, 74 % of 
women and 63 % of men stated they never work on trains. Compared to comparably lower 
income groups, the likelihood of frequently or always working on board a train doubles 
with a net household income of over 2600 euros to around 10 %. 

The current main activity in cars is, naturally, concentrating on the drive and the route. 
Around 80 % of respondents also frequently or always listen to music, around two thirds 
talk to their companions, and over half frequently or always enjoy the trip and landscape 
while on the road. Seven percent state they sometimes work in cars. 

Of the benefits that respondents perceive automated driving as having in terms of 
alternative time use during a journey, the most mentioned are being able to have con- 
versations and enjoy the landscape—the most popular current activities in cars. As an 
example, Fig. 12.2 shows the answers for fully automated vehicles. The low proportion of 
those who see a benefit in being able to work while on the move is notable; in the case of 
Interstate Pilot this is less than a quarter of respondents. 


Employment status is classed as either full- or part-time employment, or other occupation. 


N 
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The particular benefit of a fully automated vehicle is that | could ... 
.. surf the internet during the journey. SIT 
... watch movies in peace during the journey. (ss 
.. enjoy the trip and the landscape during my journey. (IS 
... use the time for social networking (via social media, text... EEE 
... work during the journey. (Tn 
.. talk to my companions during the journey. EEE 


.. relax and perhaps take a nap during the journey. (Ny 


0% 20% 40% 60% 80% 100% 
E Completely disagree u Mostly disagree Tend to disagree Tend to agree m Mostly agree m Agree completely 


Fig. 12.2 Stated benefits of fully automated vehicles. Image rights: copyright by the Author 


12.6 Automated Vehicles in Demand Modeling: The Potential 
for, and Limits to, Their Integration 


Analyzing the possible effects of the various use cases clearly demonstrates the necessity 
of differentiation when integrating automated vehicles into demand modeling. While the 
Interstate Pilot and Valet Parking functions are both to a great extent particular, tem- 
porarily restricted special forms of an otherwise largely unchanged form of car driving and 
vehicle, the introduction of fully automated vehicles involves a practically new mode of 
transport or, in the case of a Vehicle on Demand fleet, potentially a completely new type 
of mobility provision. 

Surely the greatest challenge in integrating automated driving into demand modeling 
lies in facilitating greater differentiation of the mode of passenger transport known as the 
“car.” The conventional description of this transport mode option is based on the main 
criteria of travel time, running costs, and an often not further specified preference structure 
of the decision maker. Above all, this lacks the possibility of giving the role of the driver 
and the ownership status sufficient consideration. Differentiating between driving and 
being driven, and between driving one’s own vehicle or any other one, is a prerequisite of 
adequate mapping. Only in this way is it possible to distinguish the role of the driver from 
that of the passenger or someone being chauffeured under Full Automation. Just as 
necessary is differentiation between conventional cars, fully automated vehicles, taxis, or 
hired Vehicles on Demand. The desire to integrate automated vehicles into the modeling 
therefore goes hand in hand with the need to describe the currently available individual 
alternatives with greater differentiation. The fluid transition between being a driver and a 
quasi-passenger, as experienced in the cases of Interstate Pilot and Full Automation, 
depending on the user and the journey, poses a particular challenge. 

The time spent traveling is one of the most influential drivers of transport mode choice 
in current modeling. In modeling public transport, it is common to distinguish between 
on-board or actual travel time, waiting time, and time spent getting to and from the station 
or stop. This allows the time components to be evaluated differently. Until now, however, 
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time spent in the vehicle has not been analyzed in any great depth, be it for public 
transport or any other mode. The expectations accompanying the introduction of auto- 
mated vehicles, of being able to spend time in the vehicle in a subjectively more mean- 
ingful way, clearly indicate the necessity for differentiation in the models. Journey 
distance and duration, and thus also the potential usable proportion of the journey, merit 
greater attention here, as are the questions of which alternative activities are sought and 
with whom the journey is made. 

But it is not only the time in the vehicle that is subject to change, there is also the most 
notable of the changes resulting from Valet Parking: minimizing the effort needed to use 
the mode at the beginning and end of the journey. The same applies for Vehicle on 
Demand. Again, we see here the necessity of further differentiating the often sweeping 
analysis of time spent traveling depending on the transport mode chosen. Concrete 
examples of this include the waiting time for a taxi and the time spent getting to one’s own 
car, or a hired one. 

One aspect that can be comparatively easily integrated into models, in simplified form, 
is the shortening of travel times resulting directly from the lack of traffic jams and traffic 
related to parking searches. More problematic is that the effect of increasingly reliable 
travel-time predictions on how cars are viewed as an alternative transport mode is usually 
unmapped in models. The increased convenience resulting from new functions such as 
Valet Parking or Interstate Pilot, the potential safety gains, and the greater flexibility of 
vehicle equipment are further examples of relevant subjective criteria that have barely 
been considered at all in model-based analyses up to now. The difficulty of recording 
subjective aspects, quantifying their effects, and taking them into consideration as factors 
in transport mode selection applies not only to a mode’s properties, however, but also at 
least as much to describing the user. In particular, fun while driving, the perception of 
one’s own driving skills, the readiness to hand over the driving function, the aversion to 
any potential loss of control, and trust in technology are all examples of factors that 
acquire greater relevance precisely in how automated vehicles are viewed (see Chap. 28). 
Such factors should thus be given greater attention in modeling. 

Identifying user groups that differ in terms of how they assess the various transport 
mode options is one of the most important bases of describing people in models. Both the 
literature-based impact analysis and the survey results clearly indicate that automated 
vehicles’ real or perceived benefits differ not only depending on the scenario, but also 
according to attitudes and socio-demographic characteristics. Besides the standard attri- 
butes of sex, employment status, age, and driver’s license, further distinguishing factors 
that proved relevant included, depending on the usage scenario, presence of children in a 
household, level of education, and household income. In the course of representating 
automated vehicles, an expansion of the attributes used in models to describe people, and 
particularly their household context, consequently requires debate. Furthermore, it is also 
the case here that attitudinal factors, such as attitudes towards different transport modes, 
routines or temporal constraints, are hardly ever considered. 
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For transport mode choice, holding a driver’s license and access to a car are especially 
relevant individual and household attributes. The latter is generally expressed via the number 
of cars in a household or their actual availability on the behavioral survey’s sample day. In 
macroscopic modeling, car availability is the standard criterion used to distinguish between 
user groups and determine trip rates. For transport mode selection itself, then, general car 
availability is presumed. Microscopic transport models permit consideration of driver’s license 
possession as well as the actual car availability within the selection situation—whether con- 
straints result from competition for a vehicle’s use within the household or, especially, in the 
course of a trip chain. Systems such as Vehicle on Demand systematically break down this 
restriction to availability—this type of car can theoretically be selected as a new mobility 
option by anybody at any time. Just as with carsharing systems, adequate model representation 
requires a rethinking of, not least, the geographic and social criteria of car availability. 

The consideration of geographic and contextual attributes, and the differentiation of 
possible usage or trip purposes, were given as further criteria for transport mode choice in 
models in Sect. 12.3.2. Particularly in the Valet Parking use case, the importance of 
geographic factors for how useful an option is perceived to be is intuitively apparent. 
Although the degree of detail in demand modeling is generally high enough to provide 
information about settlement structure, general land-use structure, and building density, 
details of building structure—crucial to whether there is sufficient public or even private 
parking—are not usually given. Detailed modeling of parking-space availability, pressure 
on parking space and the associated costs, and the time needed to get to and from parked 
cars are rarities (see Sect. 12.3.2). In this field, a general need for improvement can be 
stated if an adequate modeling of Valet Parking is to be achieved. 

Vehicle on Demand is another example in which urban structure determines usage and 
the state of competition between existing transport modes to a considerable extent. It 
particularly forms an alternative to private cars, taxis, and public transport in urban areas, 
for example, whereas in rural areas it is mainly seen as a potential feeder service, and thus 
as a supplement to public transport. The job of modeling is therefore to anticipate 
worthwhile deployment concepts and availabilities, and to integrate these into the inter- 
modal supply models. Further desirable improvements in transport supply models include 
the incorporation of parking-search traffic, and identifying route sections that are prime 
candidates for the use of automation. 

The Vehicle on Demand use case makes it particularly clear what fundamental impact 
automated vehicles might have on our vehicle ownership, and thus on our everyday 
mobility decisions. The modeling and quantification of causal interrelationships—between 
ownership or other options for accessing a vehicle and its most important features, such as 
being equipped with Valet Parking or Full Automation on the one hand, and the 
supply-side, the geographic setting, and socio-demographic characteristics of the 
respective household on the other—take on increased significance here. The conventional 
approach of allowing solely for the ownership of an average car as an input parameter is 
being more and more superseded, especially for emissions calculations, by upstream 
models incorporating a household car’s drive type, size class, price segment, number of 
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seats, or cargo capacity. Support functions such as Valet Parking, however, play just as 
small a role in this as the alternative of carsharing membership or getting rid of a car due 
to good provision of alternative transport modes. It is not just the question of who could 
substitute owning a car with hiring one or being driven that remains unanswered in 
conventional means of modeling. Assuming that the combination of privately owned cars 
and various Vehicles on Demand particularly promotes the flexible adaptation of vehicle 
choice to the respective usage situation, then the necessity to gather and analyze the 
necessary data, and correspondingly expand the modeling becomes apparent. 


12.7 Summary and Outlook 


It is generally expected that automated vehicles in various forms will form part of our daily 
mobility in the near future. Integrating the relevant transport options into demand modeling— 
one of the most important instruments in planning—is thus both equally challenging and 
necessary. Existing empirical work on the expected impact has until now focused primarily on 
the technology. At the same time, looking into the future is naturally full of uncertainty, and the 
effects of new technologies can only be appraised with difficulty. 

If one looks at the individual use cases with regard to their potential impact on transport 
mode choice, then the need to distinguish between them is immediately apparent. Both Valet 
Parking and Interstate Pilot are mainly associated with lightly modified “normal” cars that 
offer a benefit in special situations: improved access to the vehicle and no need to search for a 
parking space in the case of Valet Parking, optional handing over of the driving function on 
selected routes or in special driving situations in the case of Interstate Pilot. The introduction 
of fully automated vehicles brings with it the idea of a substantial improvement in how time 
spent traveling in the vehicle is assessed, accompanied by fewer obstructions to car use. 
Far-reaching effects on the whole transport system can above all be seen in the scenario of 
broad availability of Vehicles on Demand, where individual mobility will be possible 
independently of driver proficiency or vehicle ownership. Presumably, this driverless urban 
carsharing will lead to a reduction in escorting trips and taxi use, as well as a clear drop in car 
ownership. In the countryside, it could open up access to public transport. 

An online survey was employed to examine whether respondents could imagine using 
an automated vehicle in various usage scenarios and what transport modes they have been 
using until now these kinds of vehicles would substitute. Besides general skepticism, 
which even increased when the various scenarios were specified, the sizable influence of 
currently held attitudes towards cars is apparent. Sharp falls in taxi use are anticipated in 
particular. The specific advantages of automated vehicles are envisaged for long journeys 
especially, and also in the urban context in the case of Valet Parking. Taking pleasure in 
the journey and the landscape, and talking with fellow passengers are currently the pre- 
ferred activities in both local and long-distance travel with public transport; more than two 
thirds of respondents state that they never work on the move. While travelling in cars, 
listening to music and conversation are among the most common activities. When asked 
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about future time use when driving automated vehicles, enjoying the landscape and 
chatting are likewise the most prominent responses. 

Not all factors relevant to how automated vehicles are perceived and evaluated can be 
incorporated into transport models, with their simplified representation of causal interrela- 
tionships in traffic generation. In particular, non-rational, “soft” perception and assessment 
factors, such as fun while driving, or the desire/reluctance to hand over the driving task, can 
only be empirically grasped and considered in models with difficulty. Both the empirical 
basis and the implementation in models show a need and potential for expansion here. 

The main challenge in integrating automated vehicles, however, lies in what until now 
has only been a rudimentary differentiation of “cars” in models. Improvements in the 
empirical foundation, and the possibilities for integrating it into models, are again required 
here, including an underlining of the role of the driving task and vehicle ownership in 
transport mode choice. The aim is to allow for clearer distinctions between driving and 
being driven, between fully automated vehicles and ones which assist only when desired, 
and between privately owned cars, hired cars, and taxis. The need to rethink vehicle 
ownership as a fixed input variable is also apparent here. 

The possibility of spending time on the move in different ways is, alongside safety, one of 
the most-mentioned benefits of the automation of driving. Time costs are also a key factor in 
modal choice in transport demand modeling. Until now, however, no differentiation of travel 
time has usually been provided for in models. It is not currently possible to distinguish between 
time spent in a “meaningful” way and time “wasted,” between actively enjoying driving and 
being stuck in tiresome traffic jams, and between productive work and relaxed listening to 
music. Such an expansion of the models is not in principle difficult—initially independent of 
which alternative activity is actually being sought after. However, it is again evident that there 
are substantial gaps in the empirical foundation upon which demand modeling is built, that 
need filling before an adequate integration of automated driving can be achieved. 
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on the Vehicle Concept 


Hermann Winner and Walther Wachenfeld 


13.1 Introduction 


Since Carl Benz invented the automobile in 1886, some very different vehicle concepts 
have been developed. Some can be regarded as the logical continued development and 
replacement of former concepts, such as the renunciation of the carriage design and the 
integration of the wheels and chassis under the (self supporting) body. The main factor 
that influences the vehicle concept is the purpose. This can particularly be seen when 
considering commercial vehicles. However, a wide range of passenger cars has also been 
developed, from convertibles and SUVs characterized by the owner’s lifestyle to 
multi-purpose vehicles with sedans and hatchbacks as well as station wagons and (mini) 
vans. The type of use is even more important for small delivery vans, minibuses and what 
are known as light trucks on other markets. Under the hood, there has been a move toward 
transversely installed front engines with front-wheel drive over the past decades, after the 
dominance of longitudinally installed engines with rear-wheel drive. Furthermore, there is 
currently a trend towards electrification of the power train, deemed more sustainable due 
to CO; specifications, less noise emission and other advantages. Despite all these changes, 
it is not expected that the existing drive concepts will “die out”, since the divergence in the 
optimization aims of the different market segments will continue to support this diversi- 
fication of concepts. For example, a rural area in the USA has completely different drive 
requirements to a big city in China. 
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The diversity of vehicle models available on the market is accompanied by the concept 
diversity of “show cars” presented at motor shows. Assistance systems and partial 
automation are only concept changing in very few cases for familiar vehicles. The visible 
trend over the past years of poorer outward visibility in vehicles, justified by styling 
requirements and/or requirements relating to the body rigidity does, however, support the 
use of compensating systems such as ultrasound parking aids, rear-view cameras or the 
surround-view display. However, driver assistance systems generally do not change the 
concept, as only a few are included as standard equipment for a vehicle model series. As a 
result, the vehicle manufacturer is required to design the vehicle so that vehicles without 
this equipment can also be safely driven by the driver. As the willingness and ability of the 
driver to take over are also prerequisites for partially automated driving [1], major changes 
compared with conventional vehicles cannot be expected. Only concepts that benefit a 
takeover, such as new human-machine interfaces for assigning a partially automated 
function may find their way in [2]. Not only former concepts, but also current 
drive-by-wire concepts with alternative control elements (see [3]) were restricted to 
replacing the function of the steering wheel and pedals without providing a design for the 
automation of the higher vehicle guidance levels that are indispensable for automated 
driving. 

Although it is not yet possible to determine a trend toward another concept due to 
higher levels of automation, this may change with a considerable change in vehicle 
guidance. This results in the following question: If the opportunity of autonomous driving 
unsettles the current world of concepts, is this due to a significant shift in market shares or 
due to new concepts? 

Before addressing this question in detail, the key conceptual features must be defined in 
order to create a level plane that applies to the overall vehicle and so that the even more 
diverse world of detailed solutions can be faded out. Prior to this, the requirements that 
will dominate concept selection in the future should be identified. 

Figure 13.1 shows a selection of areas from which the requirements result. Many of the 
requirements are linked physically—often with conflicts—and can only be combined after 
a process of weighing up and prioritizing, for example streamlined aerodynamics versus 
distinctive styling components. 

A distinction is made between the following domains 


— Vehicle body 

— Drive 

— Chassis 

— Interior 

— Human—Machine Interface (HMI) 


for this discussion of the top concept level. As major vehicle component clusters, these are 
always linked to the occupants and the environment, especially the road environment. 
The interaction between these areas can be represented abstractly as transfer of mass, 
energy and signals (see Fig. 13.2). Since vehicle automation radically changes this 


13 Effects of Autonomous Driving on the Vehicle Concept 257 


Areas with requirements to consider 


Aerodynamics Safety concept 


Styling Concept segment 


Engine + 
powertrain 
concept 


Production + 
customer service 


Vehicle concept and 


= S = 


Cost of 


Exterior 
dimensions 


Interior 
dimension 
concept Chassis concept Product costs 


ownership 


Fig. 13.1 Requirement areas for a concept decision [4]. Image rights: copyright by the Author 
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Fig. 13.2 System analysis: driver-vehicle environment. Image rights: copyright by the Author 
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transfer, the modules are also affected. One example of the effect of automation is the 
exchange of signals between the environment and humans. The occupant no longer has to 
pursue the task of driving and therefore no longer has to exchange signals with the 
surroundings in order to reach the destination. This approach based on the transfer of 
mass, energy and signals makes the further structuring of the analysis possible, taking 
interfaces into account. 

These concept-defining areas and their interfaces for the use cases selected in Chap. 2 
as well as the application scenarios possible as a result are examined in the following. 


13.2 Interstate Pilot Using Driver for Extended Availability 


Although the two use cases “Interstate Pilot” and “Full Automation” have very different 
performance capabilities when it comes to autonomous driving, there are no differences 
when it comes to considering vehicle concepts, since both use cases are restricted to 
having a driver available for extended availability. For the “Full Automation” use case, 
autonomous driving can be used more extensively and a takeover is requested less often. 
However, in both cases it must be ensured that vehicle guidance is possible without 
restriction by a person with driver’s license in their function as a driver for extended 
availability. Therefore, for both cases, the vehicle guidance is to be supported as a “mixed 
mode”—autonomous or manual. 


13.2.1 Effects on the Body Design 


Compared with the expected comparison concepts, which do not provide autonomous 
driving capability, no concept-defining change is perceptible for the planned continued 
manual vehicle guidance. For, as long as the extension and availability use-case concepts 
(see Chap. 2) are based on control by the driver, the degree of freedom when it comes to 
the body design is restricted. The external dimensions of the vehicle, as well as the 
positioning and size of the windows, must still be tailored to the driver, meaning that 
designs similar to those today are to be expected. 

Sensors are required for virtually every viewing angle for autonomous driving, which 
will surely result in complex package solutions if discreet visibility is aimed for as to date. 
If a standard is actually to be set given for the capability to drive autonomously, this 
would be beneficial for the developers as they would be able to occupy outstanding sensor 
positions in the true sense of the word (see Fig. 13.3 as an example). Otherwise, no major 
deviation between the vehicle concept and comparison vehicles is expected, since these 
use cases “only” add a new feature to the existing concepts without affecting the basic 
principle of the vehicle or the application area. 
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Fig. 13.3 Team anyway test vehicle, environment sensors [5]. Image rights: Springer 


13.2.2 Effects on the Drive Concept 


There is no reason to evaluate the drive concept differently for the potentially remaining 
manual journey segments than for similar vehicles that are not autonomous. However, 
autonomous driving simplifies incorporation into the traffic telematics compared with 
manual driving, making more efficient driving possible. The driving characteristics can be 
controlled depending on time and energy requirements. In principle, these options are 
already available on vehicles with partial or highly automated driving functions, meaning 
that the next step towards autonomous driving results in barely any relevant changes to the 
drive concept. It is more the new networking options which benefit the drive concepts 
with lower overall availability, such as battery-electric drives. 


13.2.3 Effects on the Chassis Design 


While manual driving needs a chassis with the standard requirements, long phases of 
autonomous driving enable the occupant(s) to be decoupled from the driving process. 
Automation needs neither tactile sensitivity for driving dynamics nor the transverse and 
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longitudinal force action which impacts the occupants with vehicle acceleration. It can 
revert to the vehicle motion sensors that have long been in use for electronic stability 
control in order to regulate the trajectory so as to make the latter dynamic and 
comfortable. 

A tilted chassis as available for rail transportation for some time could at least com- 
pensate for the standard moderate lateral accelerations of 1-2 m/s”. This would require an 
overall tilting angle of approximately 6-12°. This overall tilting angle can be represented 
by the tilting angle of the road surface, the vehicle configuration roll angle and the seat 
angle, see Fig. 13.4. It seems possible that lateral force compensation can be achieved 
using the chassis alone, as the 2014 market launch in the S-Class Coupé model of 
Mercedes-Benz initially shows. By contrast, the deflection and rebound required for 
longitudinal force compensation is more than double the current spring travel. To achieve 
a compensation in the specified range here too, this would only be possible by imple- 
menting (separately or additional) seat tilting. 

As fascinating as the idea of a journey free from longitudinal and lateral forces is, 
especially for rest periods, it is equally problematic with respect to the desired visual 
connection between humans and their environment, since the visual impression no longer 
matches the kinesthetic and vestibular impression. However, even with visual decoupling, 
the rotational acceleration which is sensed in the vestibular organ can cause occupants to 
feel unwell. This is because, unlike translational acceleration, this cannot be compensated 
for if the passenger cell cannot be turned against the vehicle’s direction of travel. In 
addition, it is not possible to adjust the tilt angle without rotational velocity and accel- 
erations, which significantly reduce the tilt dynamics. Thus, with a perception limit for the 
rotational acceleration (rolling) of 4°/s? as determined in experiments [6, 7], the target 
angle for acceleration compensation is not achieved for 2.5 s. With a very anticipatory 
autonomous driving style where there are no external interferences, such as other vehicles 
which have to be reacted to with high changes in acceleration, this can just still be 
considered in trajectory planning. The perception limit used is the result of an experiment 
and therefore dependent on the underlying test setup. Other experiments give different 
values depending on the corresponding test setup, the rotation axis and the test person 
(0.3-6°/s”). A compilation of different studies into this topic can be found in [7-9]. 


Fig. 13.4 Tilting concept when cornering: left addition of forces impacting on occupants; center 
seat angle; right angle by means of chassis. Image rights: copyright by the Author 
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Compensating for the disturbance from vertical forces seems to be simpler. In con- 
junction with the front surroundings sensors, the feeling of a sedan chair should be 
possible. For reasons of safety this decoupling should be deactivated in order to give 
priority to the driving dynamics. This sedan chair could be based on electronically con- 
trolled air suspension concepts with adjustable dampers or fully active electromechanical 
spring-damper units. Relevant counter measures generally have to be taken in order to 
avoid low-frequency pitching movements which cause “seasickness”. 


13.2.4 Effects on the Vehicle Interior and Human-Machine 
Interaction 


The necessity of an available driver means that a driver’s workplace must always be 
provided. For this reason, the arrangement of the vehicle interior will be characterized by 
the need for a seat with a dashboard and operating elements. This means that no major 
concept changes are to be expected within the framework of the use cases considered 
(Interstate Pilot and Full Automation). As an alternative to the currently familiar human 
vehicle control using a steering wheel and pedals, an alternative control concept may be 
implemented, drawing on partially automated basic functionalities. This could also be 
linked with other space-saving control elements. Otherwise, several concept vehicle 
examples include the option of moving the control elements, particularly the steering 
wheel, to a less disturbing position, meaning that the space in front of the driver is 
available for the “alternative program” during autonomous driving. Some kind of lock for 
the operating controls may also be required so that they are not accessed accidentally, 
causing an unintentional takeover. 

As well as using the driver’s workstation as a mobile office for work or a media 
platform for entertainment, autonomous driving also allows the travel time to be used for 
relaxation or communicating with fellow passengers. Accordingly, for vehicles with this 
use case, the seating concept is expected to accommodate the respective requirements, 
although a lot of it is already implemented in current vehicles, even if not for the driver’s 
seat. 


13.3 Autonomous Valet Parking 


Autonomous valet parking can help to solve the parking space problem for private car 
owners in residential areas or at workplaces and, for car-sharing users, can bridge the gap 
between the car-sharing parking position and the desired point of entry or exit (Chap. 18). 
Apart from this feature, the vehicle is a completely “normal” vehicle, which provides the 
existing capabilities for assisted, partially or highly automated driving. 

When there are no occupants or objects in a vehicle, it is possible to use the free space 
in the vehicle with a variable body concept. Concepts with this function already exist 
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today, enabling the dimensions of a vehicle to be reduced during parking. However, the 
authors are not aware of any use in series production, probably because the requirements 
for high passive safety clash with the requirements for a variable body. Although 
autonomous valet parking is advantageous for this type of space-saving due to lower 
parking rates, at the same time it reduces pressure on making the most of the space 
available, since the route to a large parking space is now tackled without cost or 
time-pressure. It is difficult to predict whether the fuel consumption for the route to the 
parking space ends up being more than for searching for a parking space. 

Otherwise, autonomous valet parking does not result in any other fundamental degrees 
of freedom for the vehicle concept. 


13.4 Vehicle-on-Demand 


The vehicle-on-demand use case refers to a completely driver-less vehicle which does not 
have a driver’s workplace and cannot fall back on the driver’s capabilities. This results in 
new degrees of freedom for the design of these vehicles. The following describes these for 
this use case. Since this concept favors use over ownership, it can be assumed that in most 
cases the user neither owns nor has ownership responsibility for the vehicle. Instead, 
service providers make these vehicles available for mobility services (Chap. 18). 


13.4.1 Effects on the Body Design 


For the use case with driving speeds of up to 120 km/h, which covers almost all areas of 
use, the vehicle body must provide the occupants with weather and impact protection in 
line with that of current vehicles. This is associated with considerable design restrictions. 
A closed passenger compartment, possibly with a convertible roof, is required for 
weather-protection reasons. A safe shell with restraints must also be planned for the 
passengers in order to guarantee the same passive safety as in current vehicles, with seat 
belts and airbags. This requirement will exist for as long as it is not possible to ensure 
accident-free operation in road traffic, which is currently not conceivable, at least in mixed 
traffic with driver-only vehicles. The vehicle shape may correspond to that of current 
vehicles depending on the purpose and target group, with a large range of variants 
possible. One-box cars provide the best space economy. Like a cuboid, they are not 
lowered at the front or rear of the vehicle. Of course, designers will also make an effort to 
present the selected shape to appeal to the customers. However, with the wide range of 
possible uses for a vehicle-on-demand concept, the styling target is still largely unclear, 
especially to what extent individual emotions will be catered to. A look at the history of 
road vehicles shows that there are examples for almost every body design that are 
regarded as aesthetically successful or unsuccessful. As a result, it is not possible to 
predict a trend from the shape alone. However, all vehicles that include speeds higher than 
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the 120 km/h specified here will have aerodynamic state-of-the art shapes, meaning that 
they will have curves and aerodynamic tapers and air flow break-away edges [10]. 

As well as its protective function, the shell around the passengers is also responsible for 
connecting the passengers with the environment. In principle, full decoupling is possible 
as there is no need to guarantee that the driver can see. This enables private use of the 
cabin for entertainment and relaxation, virtually free from visual and acoustic distur- 
bances. However, the influence of driving dynamics can only be insulated to a certain 
extent, as described in Sects. 13.2.3 and 13.4.3. There will always be the challenge of 
guaranteeing that the impressions of the different senses correspond, as otherwise this 
results in discomfort or even sickness, which is unlikely to result in insulation concepts of 
this type being accepted. Figure 13.5 shows what a complete decoupling during the 
journey would look like on public roads. 

The range of alternative activities made possible by this decoupling is large and ranges 
from reading in a relaxing “environment” (right-hand vehicle) to exciting entertainment 
on racing tracks (left-hand vehicle). The challenge of guaranteeing that the impressions of 
the different senses correspond also applies to the artificial representation of the envi- 
ronment. The option of selecting the degree of decoupling using manually operated covers 
(blinds) in the simple case to high-tech solutions such as electro-chromic windows defi- 
nitely makes it easier to reach a compromise. A virtual connection with the environment in 
the form of live camera images of the environment which can be shown (on screens, as a 
projection) is also conceivable, but requires a very high level of passenger trust in the 


Fig. 13.5 Decoupling the passengers from the real road traffic. Image rights: copyright by the 
Author 
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reliability of the technology. Traveling in an autonomous vehicle should not be associated 
with the fear of being exposed to an insulation cell without contact with the environment, 
even temporarily. A compromise between the virtual and real world is the provision of 
information about the environment in the form of an “augmented reality”, in which 
information about landmarks is shown as they are seen, for example. 


13.4.2 Effects on the Drive Concept 


It is not possible to derive any restrictions for the drive from the use case alone. Both 
classic combustion engines and electric drives as well as mixed forms (hybrids) are 
fundamentally suitable. Their advantages and disadvantages also apply for 
vehicle-on-demand. On the one hand, there are the storage and charging advantages of 
chemical energy that allow the vehicles powered by combustion engines to have a larger 
range, and on the other hand, the noise and pollutant emissions advantages of electric 
drives which are particularly valued in areas with a high population density. It must be 
ensured that there is enough energy on board for the intended trip for vehicle-on-demand. 
Therefore, a supply concept where a vehicle charges during time spent stationary is 
assumed. Suitable service points will offer this service both manually and automated, 
whether at conventional fuel filling stations or special electric charging stations. Inductive 
battery charging is particularly suitable here. Depending on how much the vehicle is used, 
the disadvantage of higher charging times for electric vehicles has varying impacts: If the 
stationary times are still higher than the traveling times, the charging times are generally 
part of the non-use time and therefore do not represent a high economic strain. This is 
different when the vehicles are intended for use almost around the clock. When this is the 
objective, the time required for energy provision is of considerable consequence, since 
charging the batteries results in a significantly larger drop in use than refueling vehicles 
powered by combustion engines. 

(Hydrogen) fuel cell drives will be easier to implement with vehicle-on-demand con- 
cepts since a service provider—possibly even in association with other providers—can 
integrate the tank infrastructure into the process better than standard vehicle users. This 
means that parking spaces (= disposition points) and hydrogen filling stations can be 
coordinated, both with respect to the location and the process. The routes can also be 
designed based on the connection between the hydrogen filling stations from the start if 
one filling is not sufficient for the mobility service. Additionally, unavoidable evaporation 
losses that occur with hydrogen pressure tanks when stationary can be minimized to a 
large extent since the time spent stationary should be very low for vehicle-on-demand 
with economical operation. Despite the advantages of the vehicle-on-demand concept for 
(hydrogen) fuel cell technology, both channels, i.e. vehicle-on-demand and hydrogen 
drives need to achieve access to the market independently of one another. (Forced) 
coupling of the technologies for the market launch only reduces the prospects for both, 
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since it results in only a fragment of the use options and therefore a limited market volume 
which is too small to justify the investment for both technologies. 


13.4.3 Effects on the Chassis 


Force transfer for vehicle-on-demand will continue to be the responsibility of the tires, 
since neither the advantages nor the disadvantages of alternative concepts (e.g. air 
cushions/propellers, magnetic levitation drive, chains) are significantly affected by vehicle 
automation. The driving dynamics requirements are also only going to change minimally, 
and the requirement of a particularly sporty chassis is unlikely to be included in the 
requirements specification for a vehicle-on-demand. The deceleration and evasion capa- 
bility (i.e. acceleration of up to ~10 m/s”) will barely be lower than on current vehicles, 
even if a considerably more comfortable vehicle guidance is to be expected. However, 
with vehicle-on-demand, it is possible to plan the maneuver predictively in advance and 
thereby make the most of the opportunities provided by the existing driving dynamics, 
which could result in new opportunities for the chassis design. 

As well as the two aspects discussed in the following sections, wheel layout and steering 
concepts, the same considerations regarding decoupling from the driving dynamics as 
described in Sect. 13.2.3 apply. This is particularly true for vehicle-on-demand vehicles 
with the purpose of transporting persons on longer journeys. Although decoupling the 
human driver from the driving dynamics and the environment requires a huge amount of 
technical effort, it would enable better correspondence of the different sense impressions 
than if only one part of the impressions were to be decoupled. A corresponding decoupling 
would also be useful for transporting sensitive goods. 


13.4.3.1 Possible Wheel Concepts for Vehicle-on-Demand 

If we consider the stabilization task for a human driver, vehicle-on-demand makes it 
possible to select a wheel concept without taking currently applicable requirements into 
account. This degree of freedom motivates existing concepts with fewer than four wheels 
to be reassessed for use as vehicle-on-demand. 

As proven by motorbikes and three-wheelers, vehicles with fewer than four wheels are 
also suitable for transportation. In principle, one wheel alone is sufficient for movement, 
as unicyclists impressively demonstrate. Regulating the position of the center of gravity is 
the most important role here. A mechatronic system could take on the task of stabilization, 
enabling just about anyone to ride and control a one-wheeled vehicle. Two methods can 
be used here: Torque generation on the wheel and displacement of movable masses. 

The first of these concepts is used on the two-wheeled SEGWAY® personal trans- 
porters [11]. “Weight shifting” via feet is sensed and the passenger angle is adjusted to suit 
the acceleration so that the resulting vector of gravity and inertial force always passes 
through the line connecting the wheel contact points. The same method is used for 
maneuvering with two wheels one in front of the other. A steering movement in the 
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opposite direction to the direction of the corner results in a rolling moment which gen- 
erates an angle which guides the resulting vector of centrifugal force and gravity through 
the line connecting the two wheel contact points. In principle, a ball drive could carry out 
this stabilization for both directions. However, it is still highly questionable whether 
implementation of this kind of stabilization is useful in the context of autonomous driving. 
The user is always strongly incorporated with the weight support. Furthermore, these 
concepts are restricted to low speeds since vertical unevenness such as curb levels or 
potholes overburden both the control dynamics and the actuator capacity and therefore 
cannot prevent crashes. This consideration also applies to single-axle two-wheelers such 
as the SEGWAY PT mentioned above. These vertical obstacles are not a problem for 
motorbikes in transverse movement, even if phenomena such as kick-back reveal the 
sensitivity of vehicle stabilization of two-wheelers. 

In the same way as tightrope walkers use their arms to balance, in the second concept, a 
mass is displaced in such a way that the center of gravity is moved to suit the longitudinal 
or lateral forces without any help from the occupants. To stabilize this displacement, 
torque is briefly applied to the wheels. The SEGWAY P.U.M.A. (Personal Urban 
Mobility and Accessibility) concepts [12] and the implementation by General Motors as 
an EN-V (Electric Networked-Vehicle) [13] are used in connection with autonomous 
driving. The good maneuverability (turning on the spot) and lower space requirement 
mean that this vehicle is well suited to urban use, and this is, of course, not only restricted 
to autonomous driving. The disadvantages are the permanent stabilizing effort which 
“consumes” a larger share of the energy on board and the sensitivity to vertical levels 
specified above, although the design results in this being less than expected since the 
movable mass can reduce the drive torque required for correction here. According to 
statements to date, the maximum speed is planned to be 25 miles an hour, or 40 km/h. 
This concept is hardly suitable for use up to 120 km/h. 

Movable masses can also be used for the classic single-track two-wheeled layout, 
although it is more difficult to satisfy the space requirement for the displacement option in 
the transverse direction than in the longitudinal direction for a single-axle two-wheeled 
vehicle. For this reason, a steering actuator that can carry out balancing seems more 
promising for autonomous motorbike guidance. However, it remains questionable whether 
a concept like this can comply with the mobility requirements for a vehicle-on-demand. 
Full enclosure is cumbersome and significantly increases side wind sensitivity. However, it 
should not be ruled out as, in addition to weather protection, an enclosed frame also 
considerably improves safety, as shown by the BMW C1 scooter produced from 2000 to 
2003 [14]. Equipped in this way, a single-track two-wheeled vehicle-on-demand is con- 
ceivable, possibly including stabilizers for very low speeds and when stationary. However, 
whether the special mobility of single-track vehicles, such as passing queues of traffic, can 
be implemented with autonomous driving is another question. 

The two approaches have an opportunity in common: They can both provide force-free 
driving in one direction. On the single-axle two-wheeled vehicle, the longitudinal force on 
the occupants can be fully compensated for, and on the single-track two-wheeled vehicle 
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the same applies for the transverse force. It is an open question whether a passenger 
experiencing the trip as a passive occupant finds this to be pleasant. 

With three or more wheels, a vehicle is stable without control as long as the force 
vector resulting from inertial force and gravity does not leave the area between the 
connection lines surrounding the wheel contact points. Depending on the height of the 
center of gravity h, and the driving dynamics limits to be taken into account due to the 
maximum friction coefficient Hmax, the area of the resulting vector with the road surface is 
a circle with radius Fres = hs ` Amax/g = hs ` Umax around the central point, see Fig. 13.6. 
The central point is the result of projecting the center of gravity in the x—y area of the road 
surface. The driving dynamics limits result from the (absolute value of) maximum lon- 
gitudinal and transverse acceleration in relation to gravity acceleration g (assumed to be 
the same for both directions here amax/g). If the outer connection lines of the wheel 
contact points intersect this circle, there is a danger of rolling over. If they are outside of 
the circle, it is still possible that the vehicle may roll over in unfavorable conditions, as 
proven by the well-known example of the first Mercedes-Benz A-Class (further details are 
available in [15]). 

The minimum footprint area required to resist rolling over on a three-wheeled vehicle, 
determined by the wheel contact points, is Arp3 = 3V3r2 rz, and thereby approximately 
30 % larger than the quadratic area. More problematic is the 50 % larger minimum width 
of a three-wheeled vehicle, which unlike in Fig. 13.6 is based on two corner points in the 
longitudinal direction (otherwise 73 % larger width in the position shown). For this 
reason, a three-wheeled vehicle with purely static support will be unlikely to be used for 
automated driving. 
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Fig. 13.6 Footprint area required for resistance to rolling over. Image rights: copyright by the 
Author 
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A hybrid chassis solution with a footprint that is too small for static support makes it 
possible to displace the center of gravity so that the circle drawn in Fig. 13.6 is displaced 
in relation to the chassis, e.g. moves to the left in a left-hand bend. The displacement can 
be represented using a translational movement or a rotational movement. The Piaggio 
MP3 three-wheeled scooter design is an example of the latter [16] with two front wheels 
and parallelogram kinematics enabling an angle for the complete scooter structure. As a 
result, this vehicle has a restricted static tilting stability, however it does not require 
permanent control for constant conditions, e.g. for driving on straight roads. This type of 
concept would definitely be an option for vehicle-on-demand in conjunction with the 
enclosure mentioned above and a protective frame, if the transport requirement is to 
transport one, or maybe even two people. 

Similarly, a third wheel can also complement a single-axle concept such as the EN-V 
mentioned already. Here, a wheel affixed in front of or behind the main axle is responsible 
for static support. However, the retention of rotation while stationary requires that the 
additional wheel can be steered. Four-wheel designs with a footprint that is too small to 
resist rolling over are conceivable. An example of this is the Nissan Land Glider study 
[17], a vehicle with a width of 1.10 m which can assume a lateral angle of up to 17°. 
Whether this still relatively large width compared to a scooter is accompanied by the 
advantages for a vehicle-on-demand compared to a standard vehicle of normal width 
without tilt technology is disputable. The ability to compensate for the transverse force on 
the occupants using tilt technology could be a plus point in its own right. As well as tilting 
systems, adaptive chassis with a variable track width or a variable wheelbase and variable 
center of gravity height could fundamentally also result in resistance to rolling over as 
required [18]. 


13.4.3.2 Steering Concepts 

Currently, axle pivot steering on the front axle is dominant, and there is little reason to not 
use this for vehicle-on-demand too. However, the status of alternative steering concepts 
could be enhanced by autonomous driving. These include steering by forces like a skid 
steer, which can range from different forces to different force directions on one axle, e.g. a 
negative driving force on the left and a positive driving force on the right for turning to the 
left. This concept is the method of choice for the single-axle two-wheeled vehicle. The 
steering by forces results in considerable restrictions for three or four-wheeled vehicles if 
there is not at least one additional rotational degree of freedom for the wheels to support 
steering control. 

Alternatively, multi-axle steering is possible, often referred to as four-wheel or 
all-wheel steering. Although this is known of in vehicle technology, there are only very 
few vehicles available with it. Use is restricted due to the compromise design of current 
all-wheel steering vehicles which vehicle developers have to carry out. The driver cannot 
access the rear wheel steering. It is coupled (electronically) to the front wheel steering. 
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In a trade-off, it currently supports the vehicle agility at lower speeds (<100 km/h) with 
inverse steering angles and the stability at higher speeds (2100 km/h) with concordant 
steering angles. Steering corrections are also carried out in the critical limits of driving 
dynamics. Autonomous trajectory planning could use this degree of freedom indepen- 
dently of the speed and in accordance with the planned maneuver. This would make it 
possible to change lanes without yawing, i.e. without rotation around the vertical axis, 
allowing the repercussion on the passengers to be reduced. When parking, maneuvers are 
possible that are not possible with all-wheel steering as in a standard set-up, far less with 
standard front-axle steering. 

An extreme solution would be all-wheel steering that controls each wheel individually. 
This would be able to position all the wheels in an optimum angle but which requires 
more complicated actuator systems. There is little advantage for the application as a 
vehicle on-demand. It is restricted to a displacement of driving dynamics limits of a few 
percent, principally relevant for racing and a reduction in cornering resistance due to 
restriction-free wheel control. 


13.4.4 Effects on the Vehicle Interior and Human-Machine 
Interface 


If the vehicle on-demand is used to transport passengers, the possibilities specified in 
Table 13.1 are available for the type, direction and positioning of passenger accommo- 
dation. There is fundamentally no reason not to continue with the current usual posi- 
tioning of seats in front of and beside each other, facing forwards. If occupant protection 
allows it, it is possible to deviate from this, and the fully reclined position in particular 
should be offered for relaxation, although the direction remains open, e.g. as a row of seats 
in the transverse direction or as a reclining seat in the longitudinal direction. 

As the occupants are not expected to take on any driving tasks, the interface is 
essentially restricted to entering the destination, occupant information and a safe-exit 
switch which causes the vehicle to stop at the next safe point. The first two could even be 
separated from the vehicle and could be implemented using a personal device similar to 
today’s smartphones. Advanced interactions are to be expected for controlling the 
ambiance (e.g. closing the (electronic) blinds) and any entertainment programs. 


Table 13.1 Generally possible accommodation of occupants—type, direction and position 
Type Standing Sitting Lying Variable 
Alignment To the front To the side To the rear Variable 


Position In front of each other Next to each other On top of each other Variable 
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13.5 Use Case Overall View 


Autonomous driving varies less by vehicle concept than by the use of driving time. With 
the current statistical vehicle occupation of 1.5 persons [19], the majority of these persons 
cannot make use of the options available to passengers today, such as reading, working or 
sleeping, see Fig. 13.7. Autonomous driving makes this possible. Additionally, activities 
are possible which would currently result in impermissible distraction of the driver, e.g. 
from multimedia entertainment on a large screen and surround sound to what is referred to 
as 4D cinema. 

There is a further change to the user group. Previously, a driver with driving autho- 
rization was always required. With vehicle-on-demand, this restriction no longer applies, 
meaning that new users who could currently only be passengers in the vehicle can use the 
autonomous vehicles. These could be people who are not permitted to drive due to 
physical disabilities (e.g. visual impairment) or persons who are not able to drive due to 
mental health issues or simply groups such as children and young people who are not 
permitted to drive due to their age. Accordingly, the vehicle and the operational concept 
must also be adapted for these users. First, it is necessary to define the requirements as to 
what authority the occupants have over what happens in the vehicle and on the driving. 
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Fig. 13.7 Usage options for occupants during autonomous driving. Image rights: copyright by the 
Author 
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13.6 Changes that Go Beyond the Vehicle 


If the focus so far was on the individual vehicles, the system boundary is expanded in this 
section to include interaction with the environment and other road users. The intercon- 
nectivity of vehicles will be established as technology for all (new) vehicles early on, 
meaning that the introduction of autonomous driving does not result in anything funda- 
mentally new. However, automation of vehicles also increases their performance capa- 
bility, making new forms of use possible. The higher level of precision expected in 
autonomous vehicles means that electronically controlled maneuvers are possible which 
would scarcely be conceivable in this form in current traffic. These opportunities include 
convoy driving with very small distances between the vehicles or driving in particularly 
narrow driving lanes. The impact on the flow of traffic can be seen clearly in Fig. 13.8. 
The number of traffic elements that cross the depicted traffic area per time unit increases. If 
this is coupled with the corresponding pre-emptions, this can boost autonomous driving. 
Depending on the specifications associated with these pre-emptions, the vehicle concept 
may also change, and even the appearance may change with these specifications. The 
extent to which a regulation like this can affect the vehicle concept can be seen in the 
restriction of the overall vehicle length of trucks in the EU. As a result, all tractive vehicles 
in Europe are equipped with a sheer, space-saving vehicle front, while vehicles in North 


Fig. 13.8 Reduced distances between vehicles—made possible by high-precision autonomous 
driving. Image rights: copyright by the Author 


272 H. Winner and W. Wachenfeld 


America that are not subject to this restriction have an aerodynamic hood extending 
forwards. 

Mass transfer during the journey is conceivable, if still very unusual from today’s 
perspective. This is already implemented in agriculture (e.g. unloading crops while 
reaping) and in aviation in the form of refueling while still in the air. This could save time 
and space when transporting goods or passengers. Accordingly, suitable transition areas 
would have to be included in the vehicle design. This principle is illustrated in Fig. 13.8. 
A long-distance vehicle similar to a truck transfers goods to the smaller “distributor 
vehicle” during the journey. Automation means that the journey is synchronized precisely 
and a bridge-like construction makes it possible to exchange goods. This means that 
completely new logistics and mobility concepts can be developed. However, without 
discussing the overall system, designing a vehicle does not make much sense, which is 
why this is not covered in more detail here. 


13.7 Follow-Up Concepts 


While the use cases examined throughout have the potential to help with the breakthrough 
of the technologies required for autonomous driving, a number of applications that alone 
would not be sufficient to help a technology to reach the required maturity would benefit 
from this. This would mean that roadworthy service robots would be an option, for 
example to clean roads, cycle lanes and pavements and move independently from one job 
site to the next using public roads. Other transport and utility vehicles that were formerly 
restricted to depots could now leave them, or, in other words: Depots are expanded to 
public grounds. 

This eliminates the boundaries that were placed on autonomous systems to date, both 
with respect to scaling (from household robot to walking frame and cleaning robot, to post 
delivery vehicle and patient transportation) and relating to the private, public and com- 
mercial areas in which they are implemented. These concepts would have a big impact on 
the world of work and could reduce the number of people employed in the mobility sector 
in a wave of rationalization. This use case, following the vehicle-on-demand concept, has 
the potential to considerably reduce the number of professional driver jobs in particular. 
As well as the world of work, these vehicles could also revolutionize access to goods in 
particular, since it would be possible to automate the path from request for goods to the 
physical delivery (Chap. 16). Pilot projects with multi-copter “drones” are already 
sketching out this path for light goods. The unbeatable energy efficiency advantages of 
wheeled vehicles means that the demand for autonomous wheeled vehicles for the 
delivery of heavy goods is sure to come. 
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13.8 Summary 


In summary, the following three main points can be identified for concept changes after 
analyzing the four use cases: 

With autonomous driving, no-one is bound to the task of driving for the duration of the 
trip. This results in freedom as to how to use this time. The different uses will have a 
considerable impact on the vehicle interior and the design of the human-machine 
interface. 

Not having to take on the task of driving means that a change in the connection to the 
environment is possible. This applies both to the haptic channel for decoupling the effect 
of force from the road surface and driving dynamics on the passengers and to the visual 
decoupling. However, there are reservations here due to possible conflicts between visual 
and vestibular perception as can be observed in driving simulators today. This can only be 
solved by completely decoupling both worlds, i.e. when there is no visual impression from 
the outside and no force affecting the passengers. This would not only be very compli- 
cated to achieve for the chassis, but might also be alarming for passengers. 

Since autonomous driving is always carried out by means of by-wire actuator control, a 
very high level of motion control accuracy can be assumed. On the one hand, this enables 
new steering concepts, possibly even connected with anti-roll over devices on vehicles 
with a footprint that is not sufficient for resistance to rolling over alone, especially if 
steering by humans is no longer planned. On the other hand, this precision enables 
connection to other autonomous vehicles with the same level of precision in order to better 
utilize the infrastructure or to enable concepts that still seem very unusual today, such as 
car-to-car mass transfer. 


13.9 Will Autonomous Driving Revolutionize Vehicle 
Concepts? 


Automation will not instigate a revolution in vehicle concepts. Although some concepts 
are less “disadvantaged” by automation, classic vehicle concepts such as four-wheel 
passenger cars are expected to continue to dominate in the world of automated road traffic. 
However, new opportunities arise for special niche use areas, only the appeal of these 
niches is driven more by the specific regulations and access restrictions than by the 
superiority of the concept for general individual motorized traffic. 

As is already the case today, it will be the use that determines the concept for 
autonomous vehicles, and using the gained travel time will stimulate vehicle interior 
designs in particular. 

Automated driving technology may well result in even more differentiation in the 
market than today: 

On the one hand, there will be expensive, comfort-based high-tech vehicles resembling 
sedan chairs that serve as a moving living room, office or bedroom. 
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On the other hand, low-cost utility vehicles will be used that have the equipment 
required for transport services but which resemble small city buses and are neither 
emotionally attractive nor especially comfortable. 

The technology developed for the use cases specified above will result in lots of 
spin-off applications that may significantly change the service sector. 
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Implementation of an Automated 1 4 


Mobility-on-Demand System 


Sven Beiker 


14.1 Introduction 


There is currently much discussion, development and research, both in expert circles and 
in the public sphere, concerning automated (or often “autonomous”) vehicles. Within this 
discourse, personally used vehicles assume a central position, that is to say, focus is 
geared toward increasing vehicle automation on city streets and highways. While the 
vision of automated passenger vehicles operating with no human intervention still seems a 
long way off, there are already examples where, either today or in the very near future, 
self-driving vehicles are or will be deployed in public transportation. The past few decades 
have given rise to successful railroad systems requiring no operating staff, and now the rail 
as a guidance medium is being replaced on our streets by satellite navigation and obstacle 
detection systems, which allow for an automated journey to the user’s destination of 
choice. 

A wealth of experience can already be derived from such automated transportation sys- 
tems to be applied in the future to the development of highly automated passenger vehicles, 
even if these transportation systems are frequently only operated in limited areas, such as 
downtown centers. The operational, user-specific, insurance-related or liability-based con- 
cerns for slow-moving, geographically limited vehicles are in many cases similar to those for 
the vehicles driven on highways. As such, there is a hope that the automated 
mobility-on-demand (AMOD) systems described here can, despite diverging objectives 
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when set against highly automated sedans or SUVs, highlight a number of synergies, thus 
pointing the way forward for the deployment of the latter on public roads. This contribution 
will report on the implementation of such a transportation system at Stanford University in 
California. The goal of this report is to detail the findings and assist in future implementation 
of other automated vehicles. 


14.2 Definition and Scope 


This contribution primarily deals with “automated mobility on-demand systems”, or 
AMOD for short, and the respective vehicles that make up these systems. The term 
“automated” should be understood here in the context of vehicle automation, whereby 
computer systems are integrated into road vehicles in such a way that persons are relieved 
from the task of driving the vehicle. In the example dealt with in this report, driving tasks, 
which comprises “navigation”, “lane keeping” and “stabilization”, are performed in their 
entirety by computer systems. A driver is thus no longer necessary. In some cases even, no 
persons (i.e. passengers) are present in the vehicle at all. A vehicle may, for example, 
undertake an unladen journey for logistical purposes. This automation level is also termed 
“full automation”, in accordance with the definition provided by SAE J3016 [1]. 

The term “on-demand” denotes a transportation system that can be scheduled by the 
user for individual use (compare Chap. 2). This can be done via smartphone app, for 
example, whereby the user can summon the vehicle to his current location. This works in 
much the same way a taxi does, but with the notable difference that these vehicles do not 
require drivers. The term “transportation system” here denotes the aggregate system 
comprising several vehicles and a central infrastructure, which coordinates the vehicles for 
customer use. 

The considerations presented in the following report relate to a mobility system in a 
urban area, i.e. a developed area with a high population density. This consists of roads, 
parking lots, bike lanes, sidewalks, pedestrian zones and buildings, where the trans- 
portation system will operate for the purposes of passenger transportation. The size of the 
urban area is less important here than the urban-structural characteristics—in other words, 
it is not of particular significance whether the area in question is a so-called “megacity” or 
simply a central area of a mid- or even small-size city. The transportation systems dis- 
cussed here are considered as a general service in places where public transportation or 
personal automobiles do not represent an optimal solution for user mobility needs. 


14.3 Description of an AMOD System 


This contribution describes a concrete example of an AMOD system, namely the Navia, a 
vehicle produced by the French company Induct [2]. Between July 2013 and February 
2014, this vehicle was made available to researchers at Stanford University for assessment 
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purposes, meaning that from 2013 onwards, an operating design could be created for a 
transportation service with this vehicle. The empirical findings were documented and are 
the subject of the report that follows. Vehicles such as the Navia are highly indicative of 
general industry trends in automated system design [3-6]. But it is important to clearly 
emphasize, that the particular attention paid to the Navia here in no way represents a 
preference for, or endorsement of, that system over others. The company Induct also had 
no influence on the descriptions or findings discussed in this report. This means that while 
the following information is based on experiential knowledge derived from an analysis of 
the Induct Navia at Stanford University, it is also generally applicable in scientific and 
transportation-planning terms, as relates to AMOD systems. The information can thus 
provide a point of reference for the implementation of future systems. 


14.3.1 Technical Design 


The AMOD system discussed in this contribution makes use of vehicles equipped with 
satellite navigation systems, lasers, cameras, ultrasound and steering-angle and 
wheel-angle sensors. These sensors and systems determine and monitor the vehicle’s 
position and environment. While satellite navigation already allows for a high precision 
localization of the vehicle (even on a centimeter level, in cases where additional corrective 
methods are used), the vehicles considered here in addition utilize a process known as 
“Simultaneous Localization and Mapping” (SLAM). 

For this process, the vehicle is guided by operating personnel within a planned oper- 
ating area, while the coordinates from the satellite navigation system and the data retrieved 
from the laser, camera and (if necessary) ultrasound systems are recorded. A digital map 
of the operating area, which unlike conventional maps is a three-dimensional represen- 
tation, is created from this data. This representation describes the stationary situation in 
the operating area. In other words, all variations, as measured against the saved data in 
subsequent vehicle operation, are classified as movable or “new” obstacles. Such varia- 
tions warrant special attention and may necessitate a deviation from the pre-programmed 
route. 

SLAM technology here represents a “virtual railway line”, whereby physical tracks are 
replaced by satellite navigation, which, in connection with environment perception, is 
used as a reference system. Deviations between the saved representation and the con- 
tinuously updated environment perception data are classified as obstacles, which may 
necessitate a change of route or road. Here, the laser sensors serve mainly as a means of 
detecting objects (e.g. persons, vehicles, buildings, obstacles) at medium-to-long-range 
distances ranging from approximately 1 up to 200 m from the vehicle. The ultrasound 
sensors are used for object detection at close range (less than 2 m from the vehicle). In 
addition, the camera systems provide extra information about the shape and type of 
detected object (e.g. person or plant), to provide the most detailed possible image based on 
object type, distance, direction and, in some cases, speed. 
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Variations from the reference system, i.e. obstacles on the planned route, are 
acknowledged by the vehicle’s control unit and the actual route can be updated in line 
with a series of assessment criteria. In other words, an optimal route and pathway is 
calculated and created in accordance with the specified destination and the given traffic 
situation and environment. Even if no path seems accessible at a given moment—for 
example if the vehicle sensors detect that an obstacle cannot be bypassed and there is no 
alternative route—the vehicle interrupts its journey until the obstacle is removed. 

Driving commands are sent from the path-planning unit to the electrified steering, 
braking, and drive systems and are then executed. The vehicle features electronic inter- 
faces for these components, so that the central control unit can relay steering, braking and 
drive commands, with the result that the vehicle executes the journey independently, 
depending on the combination of environmental perception, information processing and 
destination input (see Fig. 14.1). In doing so, each axle is powered by a brushless 
48 V/8 kW electric motor. The vehicle features independent steering on the front and rear 
axles. The vehicle’s maximum speed is 40 km/h but is limited to 20 km/h for initial 
operation and can, if necessary, be further reduced via parameterization. The turning 
diameter is 3.5 m. 

The vehicle user has several options in terms of influencing vehicle operation. The 
vehicle can be requested via an input screen at a fixed station whereby for typical oper- 
ation the command will be sent using a smartphone app. Once the vehicle arrives at the 
requested pick-up location, it stops at which point the parking brake is activated and the 
door (in this case an open steel frame structure) is opened so that the passenger or 
passengers can safely enter the vehicle. The user then enters the desired destination via the 
installed input screen. The vehicle door closes and the parking brake is released so that 
the vehicle can start the journey. At all times, passengers have the possibility of stopping 
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Fig. 14.1 Block diagram of an automated vehicle (schematic, simplified) 
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Fig. 14.2 Open design of the 
Induct Navia [2] 


the vehicle immediately using an emergency switch. In such instances, the vehicle 
occupants can also contact operating personnel using a vehicle communication system in 
order to request help or to communicate other concerns. Because the connection is 
radio-based, the operating personnel can be situated at a location completely independent 
of the operating area. 

As shown in Fig. 14.2, the vehicle is characterized by its extremely open design. There 
are no body panels above waist-height (of the passenger) but rather four support pillar for 
the canopy roof. In addition, there are no seats in the vehicle. Passengers instead lean 
against upholstered supports. The vehicle has space for up to 8 persons and can carry a 
maximum weight of 800 kg. It measures 3.5 m x 2.0 m x 2.5 m (length x breadth x height). 

The power supply has an estimated operating time of 8 h using a chemical battery, or of 
20 min using a supercapacitor. The vehicle can be charged either outside its operating hours 
by means of a cable connection or during short breaks by means of a wireless charging 
station. The wireless charging option is particularly advantageous for the driverless oper- 
ating model since the vehicles are then capable of driving to the charging station themselves 
without the need for personnel who would otherwise need to plug in a charging cable. In 
case of the operations at Stanford University, the cable-charging process has been used as an 
initial solution because of its simplicity for test operation with on-site operating personnel. 


14.3.2 Operation 


Despite the largely independent operating characteristics of an AMOD system, there are 
several special conditions that warrant consideration. Firstly, operating personnel are 
required to safeguard operation. While it is not necessary for staff to oversee every 
individual steering, braking or drive command, but they must ensure safety of general 
operation within the established operating area (with its geographical limits) and specified 
parameters (e.g. speed or position). To achieve this, operation centers are established 
similar to those used for driverless trains or for logistics systems. Those centers are staffed 
with comparatively small numbers of personnel who monitor a large number of vehicles. 
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The operating center is connected via radio to the individual vehicles and is capable of 
monitoring vehicle operating data, halting the vehicle in an emergency and communi- 
cating with passengers. 

A communication system must always be installed in these vehicles for operational 
monitoring purposes. This can involve various communication standards, for example a 
cellular or WiFi network. It is essential in both cases that the latency and availability for 
the data transfer are up to the necessary requirements. 

It should be mentioned at this point that, due to continued radio monitoring and the 
ever-present vehicle take-over function, the system is not fully-automated in the strictest 
sense of the definition according to SAE J3016 [1]. This standard specifies that there be no 
human monitoring or control-takeover, even in exceptional circumstances. Nevertheless, 
one must consider, in the case of transportation systems such as the Navia, that no 
operating personnel is in the immediate vicinity of the vehicle, which means that these 
vehicles must be able to deal with an emergency situation independently. This, in turn, 
corresponds to full automation as per SAE J3016, while also demonstrating the limitations 
of this definition. 

Furthermore, a route network and operating times must be established for system 
operation. This entails defining which routes (detailed bounds) can be traveled in which 
area (general bounds). A specific area is chosen after first defining which general location 
will be best served by the transportation system on the basis of user needs, monitoring 
requirements, driving performance, legislation, economic efficiency and any other relevant 
considerations. In the case of the AMOD systems discussed here, this area could be 
limited to a pedestrian zone, a downtown area, or an entire city. In doing so, there must 
always be a detailed consideration, which roads or lanes the vehicles are permitted to 
travel on. 

For flexible operation of the transportation systems described here, it is necessary to 
consider that motorized vehicles are not permitted in some areas, for example pedestrian 
zones, and that in such cases an appropriate permit must be obtained for these special, 
automated, motorized vehicles. Furthermore, if the vehicles are operating in normal road 
traffic, it is likely that a special permission for operating an automated vehicle will be 
necessary in most jurisdictions. In some legislative territories, for example a number of 
states in the USA, relevant legislation is already being developed and implemented. 

In terms of operating times, it is important to consider whether the mobility service 
should be provided 24 h a day. This would be a logical and advantageous approach thanks 
to the minimal personnel requirements and it is likely to satisfy customers. Nevertheless, 
there may be a number of limitations, above all financial, that make limited operating 
hours a more viable option. One possibility is to park the vehicles in a depot overnight so 
as to protect them from vandalism. Another would be to offer the mobility service only 
when buses or other public transportation services are not running (e.g. at night) so that 
the vehicles are parked in a depot during daytime hours. 

In all these cases, the geographical and timeframe limitations applied to vehicle 
operation are comparatively straightforward and can be implemented by specifying limits 
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with corresponding operating parameters. This means using digital mapping and also a 
restricted schedule to limit operation in accordance with the operator’s specifications. 

In order to ensure that the AMOD system is operated in accordance to the manufac- 
turer’s specifications, there are certain requirements that must be met prior to commis- 
sioning, namely system installation, personnel training and personnel certification. This 
means, more specifically, that the transportation system must first be installed in accor- 
dance with the specified operating parameters. This generally requires an initial period of 
manual operation, which has been described in this report. This allows for the creation of a 
digital map, which ensures accurate positioning of vehicles during a later stage of auto- 
mated operation. 

In terms of training, operating personnel must receive training regarding the vehicle’s 
general characteristics and specific operational dynamics, which is to say the system 
characteristics, operating conditions, limitations and other relevant characteristics. 
Personnel must learn and understand these aspects of the system. In addition, vehicle 
operating safety must be checked—in a way similar to airplanes—before every new 
operating stage, e.g. at the beginning of a new day of service. Out-of-the-ordinary inci- 
dents during operation, for example a deviation from the defined route, must be inves- 
tigated and recorded in the system operating log. 

These factors demonstrate that although the vehicles in question are automated, a 
substantial amount of preparation is necessary before the system can be operated. This 
preparation cannot be carried out automatically and requires operating personnel. 
Nevertheless, it should be assumed that for the purposes of overall operation of the 
transportation system, considerably fewer staff are required in comparison to systems 
where each vehicle requires a driver. 


14.3.3 Business Model 


One of the main reasons for the deployment of AMOD systems is the considerably lower 
staffing requirements when compared to operating models with conventional vehicles. 
This has an effect on the business model. The manufacturer of the Navia system claims 
that the operating costs for public transportation can be reduced by 50 % [7] using its 
system. The business model for these systems thus allows for a considerably cheaper 
mobility solution when compared to, a taxi service for example, whereby savings are 
generated through smaller staff. In comparison, such systems have the advantage over 
passenger cars in that the user, relieved of vehicle control duties, can spend the journey 
time working or relaxing. 

Beyond that, there is no concrete evidence of additional economic advantages, since 
on-demand operating models are also possible with conventional human-controlled 
vehicles. However, automated vehicles can also run at hours that are generally less 
attractive, for example at night when there is maybe only need for one 10-min journey per 
hour. In this case, a driver would wait 50 min without revenue generated. In contrast, if an 
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automated vehicle is inactive for 50 min, the waiting period is unimportant as long as 
overall revenue in this period is sufficient. 

Up to now these systems have only been run in pilot operation, for example during 
restricted hours on university campuses or in shopping centers [3-5]. Because these types 
of operation were primarily intended to showcase the systems, the business model cannot 
yet be fully evaluated. It is estimated that commercial operation will commence in 2015, 
when the first evaluations of the business models and revenue targets of operators and 
manufacturers will be possible. 


14.4 Lessons Learned from the Implementation 
of the Transportation System 


The following section aims to provide an overview of the results of implementing Induct’s 
“Navia? AMOD system at Stanford University. Due to the fact that, up until mid-2014, 
the vehicles in question were only sporadically in operation, the following stands as an 
interim report that is to be continued elsewhere, at a later date. Nevertheless, it is still 
possible to communicate the findings of the implementation approach used, with the aim 
of helping other researchers and transportation planners in the implementation of similar 
systems. 


14.4.1 Differentiation Between Evaluation, Testing and Public 
Operation 


A range of operating phases was considered for the vehicles in this report, in accordance 
with the data in Table 14.1. The aim was first to classify the transportation system in an 


Table 14.1 Differentiation and characteristics of the three operating phases 


Evaluation phase Test phase Public operation 
Objective Risk analysis, Research project, optimization Passenger 
suitability for research of operation transportation as a 
purposes service 
Operating Non-public, limited Semi-public, limited Public, limited 
area 
Operating Limited, short trials Limited, long trials Unlimited, 24-h 
hours concept 
User group Researchers, staff Selected test users General public 
Monitoring Operating staff Operating staff accompanying Operating staff 
accompanying the the vehicle, radio connection connected via 


vehicle radio 
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evaluation phase, then to optimize it in a test phase and finally, to provide public 
operation. 

To begin with, the study is reliant on general experiential data which must be gathered 
from the vehicles themselves, since such a transportation system is still largely uncharted 
territory, making a risk assessment difficult. A range of other important questions informs 
the research. Importantly, the system described here allows for a highly flexible operating 
model to accommodate the applicable requirements. For the initial evaluation, it is 
beneficial to have a basic calibration of the vehicle to the desired operating area to allow 
for monitoring by on-site staff. To simplify this process, the vehicle should not require a 
special infrastructure, but should operate on a largely independent basis once it has been 
calibrated. 

The test operation phase that follows seeks, in accordance with the objectives of the 
Autonomous Systems Laboratory [8], to optimize the geographical and timeframe dis- 
tribution of automated, on-demand vehicles. This phase should be as realistic as possible, 
whereby system users, despite the test status, should be allowed to behave in a manner 
that reflects their actual mobility needs. For example their actions should be able to 
demonstrate a preference for the shortest possible waiting time and journey time from one 
location to another. This phase of operation must also be designed as highly-flexible yet 
target-oriented as it pertains to the transportation system discussed here, since the pro- 
vided routes and schedules are comparatively easy to program, allowing for efficient 
implementation of requirements. 

Test operation should then ultimately lead to public system operation, as long as no 
further research testing or optimization works are planned. The operational system is thus 
implemented in accordance with the results of the test operation. The transportation 
system allows for this step-by-step approach for implementation because the operating 
area and operating times are very easily set and, since the vehicle speed and overall 
distance are minimal, operational monitoring should pose if at all only few problems. 


14.4.2 Choosing a Vehicle Concept 


In order to fulfill the requirements of the test phase operation, a fully-automated vehicle— 
that is to say, a driverless vehicle—is necessary. The vehicle must be able to propel itself 
within specified boundaries, while having on-demand functionality for the user. In 
addition, open operating system architecture is required for making alterations to the 
deployment and distribution of vehicles. It is not essential here for the vehicles themselves 
to have an open architectural design: Neither the operating system for the vehicle control 
unit nor the environment perception system are part of these research efforts and, as such, 
they do not need to be altered. 

The “Navia” vehicles provided by Induct and their associated operating system 
architecture fulfill the applicable requirements. In addition, experiential data was already 
available from other projects that implemented this mobility concept [3, 7], which means 
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test operation was likely to run smoothly. Furthermore, Induct’s trademark rights relate 
primarily to the field of environment perception and reference system creation for vehicle 
automation. This means that the research presented here does not conflict with Induct’s 
work but rather complements it because it focuses on the area of general vehicle operation 
in order to best fulfill mobility demands. It is for these reasons that the Induct Navia 
concept was chosen and evaluated for test operation, in accordance with the criteria 
described in the sections that follow, as part of the research work of the Autonomous 
Systems Laboratory at Stanford University [8]. 


14.4.3 Risk Assessment and Legal Classification 


Placing this project into the context of the existing legal system is a step-by-step process. 
Because the vehicles do not initially run in publicly accessible areas (for evaluation 
purposes), a number of special rules apply in terms of vehicle operation and operating 
liability. These rules were formulated at Stanford University in consultation with the 
department for risk assessment and the university legal department. Legal liability is 
assigned, for the most part, to the operator of the vehicles in question which, depending on 
the operating mode, is the operating personnel in, directly outside or remotely connected 
(via radio) to the vehicle. The operation of the vehicles at the university has been 
approved but with certain restrictions applied by the internal (i.e. Stanford University) 
staff for risk assessment. 

The risk assessment for the vehicle operation detailed here is considerably easier to 
plan than for equivalent operation in public traffic, primarily because the vehicle speed 
and the operating area are greatly limited. That means that, in contrast to conventional 
passenger vehicles, which are considerably faster and can, in theory, travel anywhere, a 
speed limit of 20 km/h and a significantly confined area represent a comparatively small 
operating risk. To begin with, system operation in this area was only permitted without 
public access and under the direct supervision of operating personnel, directly outside, or 
directly inside, the vehicle. These restrictions placed on the first stages of operation mean 
that all project partners gain an understanding of the capabilities, limitations and any other 
characteristics associated with the system. This allows for a step-by-step risk analysis and 
legal classification process as the test phase operation itself is gradually widened in scope. 
This also means that the risk assessment and legal classification process cannot be 
accurately determined in advance and they are instead based on the practical data of 
vehicle behavior as it arises. 

With the gradual expansion of the operating model in test and then public operation 
(see Table 14.1), public legislation comes increasingly to the fore as the dominant reg- 
ulating feature, as long as vehicles are operating on public streets. For this research, 
respective regulation in California, USA was applicable. This regulation was still in the 
final legislative phase during the first half of 2014. It is important to note here that, as of 
September 2014, only vehicle manufacturers were permitted to perform tests with 
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“autonomous” (automated or fully-automated) vehicles [9]. Because the definition of 
“vehicle manufacturer” includes a person who modifies a vehicle so it become an 
“autonomous” vehicle, it remains to be seen, which roads the vehicles at Stanford will 
travel on and who the “manufacturer” is in the sense of the California law. It is assumed, 
under this law, that the vehicle manufacturer corresponds to the actual producer from 
whom Stanford University procured the vehicles and not the university’s researchers, as 
long as said vehicles are not modified by Stanford University in a way that facilitates their 
automation but, rather, their data are assessed and optimized as pertains to position, 
temporal behavior and user requirements. 

Admittedly the legal situation is currently difficult to predict since it is still in transition. 
It is likely, however, that changes will be made on a number of legislative levels (state, 
municipal and national) and that measures will have to be taken to comply. But in the 
context of the operating area dealt with here, which is to say an innovative university in 
California, the fundamental attitude of the responsible authorities and the public toward 
automated vehicles seems to be a very positive one. The relevant legal bodies also seem to 
be taking a supportive and favorable attitude. There is also a sense of confidence that, in 
individual cases, special regulation can be agreed to allow for system operation that may 
not be explicitly provided for by law. This type of attitude has also been observed in other 
parts of the USA. As such, US legislation does not seem to represent a key barrier to the 
introduction of automated vehicles but is more likely to act as an additional reviewing 
body. 


14.4.4 Contractual Structure 


For the purposes of an AMOD, a contract is required that outlines the fundamental legal 
relationship between the owner of the vehicle (for the test operation described here: the 
manufacturer) and the user (here: Stanford University as the research facility). This entails 
rights and obligations pertaining to general use, information and communication, main- 
tenance, liability and other provisions for test operation. 

In the example dealt with here, a loan agreement for one automated vehicle was agreed 
between the manufacturer-owner and the user of the vehicle that, at the outset, was only 
applicable for the purposes of the evaluation phase that would potentially lead to a 
research project. As soon as a definite project with an AMOD system is pursued, a new or 
possibly supplementary contract would be necessary which would then govern all cir- 
cumstances for effective use. Such a contract could also potentially include the possibility 
of altering environment perception and route planning technology for research purposes, 
which are not included in the evaluation phase. 

In the contract between the manufacturer-owner and the user of the vehicles deployed 
in this evaluation phase, liability is assigned to the operator. As such, the operator is the 
legal entity that initiates and monitors vehicle operation, whereby this could be either the 
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operating personnel inside or directly outside the vehicle, or the operating personnel 
remotely connected via radio. 


14.4.5 Selection of the Operating Area and Operating Scenarios 


To begin with, the operating area for the AMOD system must be geographically limited. 
For the initial evaluation and subsequent test operation phases, the size of the operating 
area is not as a much a point of focus as the range of users, use cases and operating 
situations. These factors can be proactively represented for evaluation and test purposes in 
trial form—in other words, the project parties envision and design a range of suitable 
situations in which vehicle behavior can be observed and assessed. As such, a small 
operating area is sufficient for assessing a wide range of situations and operating 
conditions. 

Because the concept of an AMOD system is a new one and, accordingly, a risk 
assessment of the system on the basis of experiential data is somewhat limited, an 
operating area must initially be found that ensures realistic operation but also complete 
control. This means that users must be in a position to request vehicles within the 
operating area, specify a destination and then give vehicle commands—all without the 
direct involvement of operating personnel. At the same time, the operating personnel must 
be able to monitor the vehicles. They should also have control of, or at least knowledge of, 
the persons and vehicles located in the operating area that could potentially interfere with 
the vehicles during this initial test operation. 

An overview of the number of persons in the operating area is important to allow the 
operating personnel to recognize and prevent collisions and other disturbances. For 
example, at the beginning of the test phase there should be no person within the vehicle’s 
operating area who is not familiar with the transportation system or who would behave in 
a way that deviates from any stipulated regulations (e.g. stepping in front of a vehicle). It 
must be ensured that all persons involved are familiar with the characteristics and risks of 
the transportation system but that these persons also behave in the way a real user would, 
in that they request vehicles and set destinations realistically. One possibility here is to 
have persons who interact with the vehicle sign a release form, which states that they are 
acquainted with the system’s characteristics and limitations and they will adapt their 
behavior accordingly. 

The operating area is thus heavily limited initially and may, for the reasons described 
previously, need to be fenced in and made accessible only with special permission. 
Moving forward, operation should then be expanded to an area that is monitored but also 
public so that a large number of real users are targeted. This involves bringing in users 
who have no prior understanding of the system and who do not sign a special release form 
—instead they should seek to use the vehicles as they would a taxi or bus. For this 
purpose, it is important that the operating area features users with mobility needs that can 
be solved by the vehicles in question, as relates to distance, speed and transport capacity. 
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A university such as Stanford is capable of implementing such a system and fulfilling 
the envisioned requirements. The university campus has grounds large enough to 
accommodate the Navia. Demand for passenger and goods transportation is high. Also, 
traffic issues are dealt with as effectively as possible by the responsible university 
department (Parking and Transportation Services). This allows for a suitable area for the 
introductory evaluation phase to which only test participants have access. In the following 
phase, pedestrian zones and streets can be incorporated. In all cases, the necessary 
communication systems for personnel monitoring must be in place, with personnel access 
to the vehicles where necessary. 

After it became know that Navia vehicles were being used at Stanford University, a 
string of university departments registered their interest in using the transportation system. 
One query came from the operator of the local bus service, which was looking for a 
flexible expansion of its services at certain points. Another interested party was the 
university’s utilities and repairs departments, which was looking for a flexible and 
unmanned system to transport items around the campus. An additional research facility 
also voiced its interest in establishing a passenger transportation system on its research 
campus. 

Taking into account the enquiries that were received and the system’s capabilities, 
operation began on an access-controlled parking lot, with a range of operating scenarios 
simulated. A subsequent more realistic trial is planned to take place on the grounds of the 
separate research facility, where both a large number of real users are expected and full 
monitoring of operations can be ensured. 

To begin the evaluation phase, a set of special scenarios must be created that allow for 
risk assessment and related safety tests. Here, vehicles can be confronted with obstacles 
and other objects. These should be genuine, safety-relevant scenarios in which vehicles 
behave in the desired manner, without faults that could lead to critical operating condi- 
tions. The objects that stand in the vehicles’ way are pedestrians, cyclists, vehicles of all 
kinds, animals and everyday objects that can be found in a normal operating area, such as 
trash bins, packages, cartons, working materials, plants, buildings, etc. 

Here, a distinction must be made between stationary and movable objects, since the 
former can be clearly defined in the digital map of the environment, which allows for the 
course of the vehicles to be determined accordingly. Movable objects—in this case objects 
that are seldom moved and only as a result of outside interference (e.g. a debris container) 
—must be fully captured by the environmental sensors in order to avoid a collision. 
Depending on the type of object, operating scenarios should be drawn up along with a 
corresponding mode of behavior for the purposes of risk assessments and safety tests: 
Persons and vehicles should be able to move in front of the vehicle suddenly—trash bins 
and packages should of course, be somewhat slower. When these objects emerge, vehicle 
behavior should be designed in such way that it is prompt and reliable enough—on the 
basis of its detection processes—to avoid a collision. 
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14.4.6 Setting up the Transportation System and Certification 
of Personnel 


The vehicle manufacturer specifies how the transportation system and its automated 
vehicles should be implemented. The first step is to establish the route. This route is then 
traveled by one of the vehicles in a special operating mode, which allows for a digital map 
of the operating area to be created. The operating data is then edited so that stationary and 
moving obstacles can be categorized. Finally, the manufacturer creates a document 
detailing the mode of use and the operating area. This should detail parameters and zonal 
limits, thereby specifying what is permissible within a certain type of operation, taking 
into account potential legal liability issues. These guidelines are then documented in a 
certificate produced by the manufacturer. 

For the purposes of issuing operating personnel with certification, the manufacturer 
provides training pertaining to operating requirements, functional characteristics, operat- 
ing modes, technical details, limitations, risks, etc. Personnel should acquire an under- 
standing of the system based on practical interaction and this understanding should be 
tested. The manufacturer documents this certification process, thereby certifying those 
persons who have successfully completed their training with a detailed knowledge of the 
system. There are also three task levels: “supervisor”, “operator” and “technician” which 
designate whether operating staff are to only monitor, generally operate, or carry out 
maintenance on or modifications to the system. 

The vehicle manufacturer must first define these processes and task scopes, since the 
manufacturer is the party with the best knowledge of the system and the risks associated 
with the vehicles. So as to be able to incorporate potential peculiarities of the operating 
environment into the organization, the operator of the system (which is to say, not the 
manufacturer but the responsible monitoring person, either on-site or connected via radio) 
should make changes or upgrades in terms of system testing, maintenance and certifica- 
tion, since it is here that unique situations become most evident. As time progresses, 
similar AMOD systems will be the subject of further upgrades and greater expansion, 
providing legislators with more experiential data. This means that, ultimately, the relevant 
processes and scopes for the certification of vehicles and personnel will likely be created 
either by legislative authorities or from commissioned institutions. 


14.4.7 System Start-up and Operational Monitoring 


For live vehicle operation, the manufacturer specifies a system start-up and a corre- 
sponding system inspection. This involves a check of the vehicle and environmental 
parameters before approval can be granted for live operation. This process represents a 
good compromise between detailed precision and manageability, so that before the 
initiation of each operating period there is total certainty that both the transportation 
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system and the operational environment meet safety and functional requirements in 
accordance with the standards for certified operation. 

For vehicle operation with radio monitoring (which involves no operating personnel in 
the vicinity of the vehicle) the manufacturer provides a communication system. This 
involves the implementation of two independent, wireless communication systems, for 
example a cellular and WiFi link or two independent cellular networks. The operating 
personnel can use this systems to access vehicle data and, if necessary, execute an 
emergency stop or communicate with the passengers in the vehicle. The exact scope of 
monitoring, e.g. vehicle position, speed, direction of travel, passenger numbers and door 
locking, in addition to full video surveillance of the environment, will be established on an 
individual basis and is currently (as of June 2014) not specified. 

Up to now, the vehicles at Stanford University have only been run with operating 
personnel in or in the direct vicinity of the vehicle with direct access to an emergency stop 
switch. For this reason there is currently no further experiential data available on operation 
with a radio monitoring connection. Nevertheless, it has been established, from this 
limited experience, that it is more likely that collisions can be traced back to other road 
users (pedestrians, cyclists, other vehicles) than to the automated vehicle itself. The 
combination of environment perception, object classification and route planning is ade- 
quate—particularly given the minimal vehicle speed and the familiar and limited opera- 
tion area—to allow the vehicle to be operated safely and without disruptions. 

For future operation with radio monitoring there will need to be an assessment of the 
response time necessary for operating personnel to arrive at the location of the disruption. 
For example, road construction or illegally parked vehicles could block the route. In such 
situations, vehicles would automatically interrupt their journey and inform the operating 
station of the disturbance. Then, depending on the working location of local operating 
personnel, a time period will elapse that could amount to minutes or considerably longer, 
before personnel are on location to solve the fault. The frame of reference here is elevator 
support, whereby activating an emergency button also initiates immediate contact to an 
operations center although it can take substantial time until staff reaches the site. It is then 
a task within public operation to ascertain how passengers in AMOD systems deal with 
such a scenario and whether the waiting time represents a problem for them. It should be 
noted that, in contrast to an elevator system, the passengers of this transportation system 
have direct contact to the outside environment at all times, thanks to the open structure of 
the system (see Fig. 14.2) and they can, in an emergency, leave the vehicle relatively 
easily. 


14.4.8 Information for Users and Pedestrians 
Due to the fact that this AMOD system constitutes a new innovation in the field of 


personal mobility, users must be informed of the risks and possibilities associated with it. 
To begin with, the particulars of normal operation need to be made clear: This means, the 
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actual control process itself should be explained. This requires a minimum of detail since 
this transportation system will allow for usage similar to a taxi or bus service—and those 
services are already completely familiar to future users. Instead, the risks and special 
attributes of test operation should be the subject of focus. This includes an explanation of 
the system’s limitations and dangers, for example the risk that it does not recognize an 
obstacle fast enough or, in some case, vehicle behavior that may be out of the ordinary. 

The users for the evaluation and test operation phases are provided with written 
information on vehicle characteristics and associated risks. This includes information 
explaining whom users should turn to as the person legally liable in the event of damage. 
Similarly, once in public operation, users should have the option of giving feedback and 
forwarding queries to the operator of the system. And because this is a new transportation 
system, user evaluations are of great importance. Therefore it is important that users know 
who they can contact to voice their opinions. 

Just as with the users of the automated system, it is important that pedestrians and other 
road users are provided with information on the operation of the vehicles. Thereby, it is 
not absolutely essential to provide them with knowledge on vehicle usage itself. However, 
given the level of interaction between vehicles and other road users, the latter must be 
informed about the associated eventualities and risks. This particularly includes 
right-of-way regulations and other special provisions. Pedestrians and other road users 
should know how they could in case of an emergency stop a vehicle from outside using 
the emergency stop function. Pedestrians should also be aware of the identity of the 
official system operator, who they can turn to and provide feedback or make queries. 


14.4.9 Public Response 


Even if, up to now, the AMOD system has only been witnessed in public operation on a 
confined scale at Stanford University (and this was only the case when the vehicle was 
transferred, controlled by operating personnel, from one operating area to another), one 
can still make several assertions about the reaction of the public. These observations are 
derived from the aforementioned transfers and from visits during the evaluation phase. 
Observations could also be made at the vehicle’s depot location. It is important to 
emphasize here that the following descriptions do not constitute a methodical study, but 
rather incidental observations that aim to provide an impetus for future study. As a general 
tule, the public—which is to say, those persons who were exposed to but not involved in 
the project—reacted very positively to the vehicle. There are two probable reasons for 
this: 

Firstly, non-participating pedestrians and observers generally seemed to be very 
interested and curious in relation to automated vehicles as a concept. This may be because 
such technologies are currently a major theme in both general media and popular science 
as well as in scientific publications. It is above all the general media that frequently 
reports, in positive, sometimes even euphoric terms, about “autonomous” vehicles in 
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which drivers hand over total control to a computer so that they are free to perform other 
tasks during their journey. When people encounter this type of vehicle for the first time 
after being exposed to such media coverage, curiosity, receptiveness and a level of trust 
are likely responses. 

Secondly, the characteristics of the vehicle in question haven been seen to bring about 
spontaneous and positive reactions from pedestrians and observers. The open structure 
(see Fig. 14.2) is one of the influencing factors: The vehicle has open, only low-rise side 
panels and an open railing system instead of a closed door. Thanks to this structure, the 
vehicle’s passengers are clearly visible to passers-by and this open visibility makes a 
positive impression. More specifically, this means that the visual impression left by the 
vehicle is very different to that of a vehicle e.g. with tinted windows and closed doors, in 
which case passers-by have no idea who is in the vehicle. This would be comparable to 
the differing impressions one would have, in normal public traffic, from a limousine with 
tinted windows on the one hand, or an open convertible on the other. In addition, the 
vehicle described here features a design concept taken from the boating industry, whereby 
epoxy is used for the body, the passenger seats are covered in beige leather, the floor is 
bright teak and the roof is sail-like in shape. Comments from the public ranged from “land 
yacht” to “a whirlpool on wheels’—all positive associations that form an initial 
impression of the technology. 

In addition, the vehicle is comparatively slow and operates at a speed that is barely 
above walking pace. This gives passers-by the impression of safety. Pedestrians feel that 
they can quickly move to the side if need be. Drivers of automobiles at the same time 
likely feel “superior” to the vehicle, which may also be due to the fact that the visible 
structure is largely plastic. As a result of these characteristics—which is to say the open 
and positive appearance, in addition to the slow speed—observers seem to attribute an 
almost personal character to the vehicle, similar to the characters in motion pictures such 
as “Short Circuit”, “The Matrix” or “Star Wars”. These movies show that robots are 
assigned different characters depending on their appearance, performance and aggres- 
siveness. These characteristics and mechanisms should be carefully considered when an 
automated vehicle is put into public operation. It seems that the “character” of a vehicle is 
an important factor in provoking a positive public reaction towards vehicle automation. 
That is to say that an automated vehicle, using a certain mechanism, can be seen either as a 
“subordinate servant” or a “ruthless mercenary” (see also the article by Kröger in this 
volume Chap. 3). 

These interactions with pedestrians and observers have produced a host of questions 
about the AMOD system. The most common question is when and where these vehicles 
will be useful in the public realm. Other pertinent questions relate to the technical 
specifications of the vehicles. Among these issues is the question of if and how vehicles 
will react to objects, very specifically pedestrians, pets, and stationary objects. Questions 
relating to monitoring and legal liability for vehicles have also been raised. These ques- 
tions illustrate the general level of public interest in the vehicles and that the public has put 
much thought into the issues surrounding the operation and limitations of automated 
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vehicles. This also underlines the importance of public awareness and information both 
before and during system operation. 


14.5 Summary and Outlook 


This article describes the first steps in implementing an automated mobility-on-demand, or 
AMOD, system. This transportation system comprises vehicles that can be summoned via 
smartphone app. They serve the purpose of transporting persons within a specified area, 
for example a downtown city area, without either the possibility of directly intervening in 
the vehicle’s operation and with no rails or tracks. This mobility concept is operated at 
Stanford University for the purposes of a scientific study in the field of innovative 
mobility solutions using automated transportation systems, with a view to examining the 
initial suitability of the vehicles for this purpose. 

The first stages of the project involved risk assessment and legal classification pro- 
cesses. The system operating area and a range of operating scenarios were then estab- 
lished. The results showed that the system can be built on the basis of existing regulations 
and provisions but that, because of its automated nature, the system entails a number of 
requirements that clearly also exceed existing parameters. As such, it is expedient for the 
vehicles to drive slowly (a 20 km/h limit) and within a limited operating area. 

In addition, operating personnel should be either in the vehicle, directly outside the 
vehicle, or remotely connected to the vehicle via radio, so as to facilitate a smooth first 
implementation of the system. In the context of the necessary internal coordination 
requirements and the necessary regulations, it has proved extremely important to 
demonstrate the system in real operation to the concerned parties and decision makers, so 
as to be able to realistically evaluate the level of operating risk and vehicle capabilities and 
limitations. The open and appealing appearance of the vehicles, combined with a great 
level of public interest and curiosity, mean that they provoke a positive response among 
the public. Consumers also expect that automated vehicles, at some point in the near 
future, will relieve them of the often burdensome task of driving in the city. 

There are, however, a number of uncertainties surrounding the implementation of auto- 
mated vehicles. These include associated infrastructural, economic and business-strategic 
variables but also an applicable legal framework. In the example detailed here, the imple- 
mentation of the transportation system at Stanford University (which represents a legislative 
area within the US State of California), or more specifically, on the university’s own grounds, 
has proven advantageous, as the university itself can directly stipulate regulations. California 
legislation is currently being processed for the operation of automated vehicles, which would 
then provide legislative boundaries for system operation in thoroughfares on the periphery of 
the campus. One will soon see how legislation for automated vehicles is to be handled and the 
system’s operation and design will need to be structured accordingly. 
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In conclusion, the current outlook is very much positive on the basis of these initial 
system trials and the positive public stance on the implementation of automated vehicles, 
which is being promoted and encouraged. It is important to note, however, that these 
initial impressions do not constitute a representative study—further efforts are required for 
implementing and promoting acceptance of automated vehicles. But in summary, there is 
hope that automated mobility-on-demand systems will make an important contribution to 
the improvement of urban mobility for individuals. 


Open Access This chapter is distributed under the terms of the Creative Commons Attribution 4.0 
International License (http://creativecommons.org/licenses/by/4.0/), which permits use, duplication, 
adaptation, distribution and reproduction in any medium or format, as long as you give appropriate credit 
to the original author(s) and the source, a link is provided to the Creative Commons license and any 
changes made are indicated. 

The images or other third party material in this chapter are included in the work’s Creative Commons 
license, unless indicated otherwise in the credit line; if such material is not included in the work’s Creative 
Commons license and the respective action is not permitted by statutory regulation, users will need to 
obtain permission from the license holder to duplicate, adapt or reproduce the material. 


References 


1. SAE International, “Taxonomy and Definitions for Terms Related to On-Road Motor Vehicle 
Automated Driving Systems” (January 16, 2014) 

2. Induct Navia Produktbeschreibung, Unternehmenswebseite, http://induct-technology.com/en/ 
products/navia-the-100-electric-automated-transport (accessed on June 28, 2014) 

3. “Induct presents world’s first fully-electric driverless shuttle: the Navia”, Induct press release, http:// 
induct-technology.com/en/files/2012/12/Navia-press-release.pdf (December 6, 2012, accessed on 
June 28, 2014) 

4. “Le Cybus d’Inria en démonstration a la Rochelle”, INRIA press release, http://www. inria.fr/ 
content/download/9864/3533 10/version/1/file/Cybus-Inria.pdf (May 12, 2011, access on January 
28, 2014) 

5. Counts, N., “SMART Driverless golf cart provides a glimpse into a future of autonomous 
vehicles”, MIT News, _http://newsoffice.mit.edu/2013/smart-driverless-golf-cart-provides-a- 
glimpse-into-a-future-of-autonomous-vehicles (December 9, 2013, accessed on June 28, 2014) 

6. “AKKA link&go 2.0 electric automated concept designed for future cities”, Designboom, http:// 
www.designboom.com/technology/akka-linkgo-2-0-electric-driverless-concept-car-for-the-city- 
of-the-future-03-12-2014/ (March 12, 2014, accessed on June 28, 2014) 

7. “Induct Launches Navia, The First 100 Percent Electric, Automated Shuttle In The U.S.”, Induct 
press release, http://www.prnewswire.com/news-releases/induct-launches-navia-the-first-100- 
percent-electric-automated-shuttle-in-the-us-238980311.html (January 6, 2014, accessed on June 
28, 2014) 

8. Zhang, R., Pavone, M., “Control of Robotic Mobility-On-Demand Systems: a Queueing- 
Theoretical Perspective”, Robotics: Science and Systems Conference (2014) 

9. “DMV Adopts Autonomous Vehicle Testing Rules“, California Department of Motor Vehicles 
(DMV) press release, http://www.dmv.ca.gov/pubs/newsrel/newsrel14/2014_34.htm (May 19, 
2014, accessed on June 28, 2014) 


Part Ill 
Traffic 


Bernhard Friedrich 


There is no doubt that road traffic is the most important mode in terms of transport and 
haulage capacity for society and the economy. Upgrading the infrastructure at bottlenecks 
on the road network, however, cannot keep pace with the demands for a compatible and 
environmentally friendly implementation, neither regarding demand for capacity nor the 
required qualities. In light of the limited budgets for building and upgrading transport 
infrastructure, only measures with disproportionately high economic benefits for any 
implementation will be looked at here. Proposals will thus only be urgently pursued when 
their benefits exceed the costs threefold, for example in federal road planning 
(Bundesverkehrswegeplanung). 

Besides tight budgets, the boundary conditions of urban construction and regional 
planning are limiting factors for the further upgrading of transport infrastructure. An 
extension to the areas used for stationary and flowing traffic proportional to the increasing 
population densities resulting from the reurbanization that has been recently observed is 
neither conceivable nor desirable. This also goes for the highly overloaded long-distance 
road network, for which there is barely any room left for expansion precisely in the 
conurbations with the largest capacity deficits. 

In light of this, it remains a primary goal of the whole of society to safeguard and 
improve the mobility of persons and goods. This is done by reducing traffic volume by 
structural changes (prevention), spreading transport demand across various modes (dis- 
placement), and efficiently using existing infrastructure. 

Besides the prospect of greater “participation in social life” travel for those groups of 
people whose mobility is currently limited, autonomous driving offers an outlook of 
significantly improved options for using current infrastructures. Moreover, there is also 
the chance here of reclaiming for other uses urban space now devoted to road traffic. 

The articles in “Traffic” approach these prospects from various angles, see how they 
hold up under examination, and demonstrate options for rolling out autonomous driving 
from an infrastructure and traffic-management perspective. Since road safety is an 
essential precondition for introducing autonomous driving, light will also be shed on 
opportunities for increasing safety and the safety risks linked to autonomous driving. 
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The chapter Traffic Control and Traffic Management in a Transportation System with 
Autonomous Vehicles by Peter Wagner describes how mixed traffic composed of auton- 
omous and conventional vehicles can be modeled in its interaction. The aim of such 
modeling is to recognize systemic effects that may arise. The simulations of motorized 
road traffic in cities carried out on the basis of this modeling permit an assessment of the 
potential effects on traffic of autonomous driving in an urban context. 

In the chapter The Effect of Autonomous Vehicles on Traffic by Bernhard Friedrich, the 
impact of autonomous vehicles on the capacities of free stretches of highways and of 
intersections with traffic lights is deduced using traffic-flow theory. It may be the case that 
the effects of autonomous vehicles on the connection qualities of journeys running over 
different infrastructure elements cannot yet be extensively described with these deliber- 
ations. However, the considerations still provide an estimate of what potential for opti- 
mizing traffic-flow efficiency might be linked with autonomous vehicles. 

Based on existing accident-research analysis, Thomas Winkle’s meta-analysis Safety 
Benefits of Automated Vehicles: Extended Findings from Accident Research for Devel- 
opment, Validation and Testing begins by documenting examples of the potential benefits 
of safety-enhancing systems with low degrees of automation. Robust studies on driverless 
vehicles with a range of functions close to mass-production levels, on the other hand, are 
still lacking. It thus remains for forecasts to estimate the theoretical potential safety 
benefits. Such estimates rest on, among other things, the fact that over IO&#xA0;% of 
today’s road accidents are attributable to human error. In light of this, the vision of 
widespread use of driverless vehicles in road traffic promises a societal benefit well worth 
striving for, even if driverless-vehicle technology does not achieve absolute perfection. 

The application of autonomous vehicles in the area of road freight transport is sketched 
out in Heike Flamig’s chapter Autonomous Vehicles and Autonomous Driving in Freight 
Transport. Taking as its starting point an analysis of a logistics chain, the changes 
resulting from autonomous driving for businesses and society are critically discussed, as 
are the necessary preconditions for its implementation. The author finds that opportunities 
for better use of the infrastructure and optimizing logistics processes can be expected to 
arise from the deployment of driverless vehicles. The reorganization of processes in many 
supply chains within the overall logistics system will be a prerequisite for this, however. 

Vehicle-on-Demand (VoD) systems are the most far-reaching application of autono- 
mous vehicles. The impact on transport is described in the chapter Autonomous 
Mobility-on-Demand Systems for Future Urban Mobility by Marco Pavone. The author’s 
deliberations make it clear that a new organization of urban traffic using VoD is funda- 
mentally possible and would bring with it many benefits. The communal use of VoD 
means far fewer vehicles would be required for equally good mobility provision. 
Autonomous vehicles’ ability to easily relocate themselves allows for supply to be 
adjusted to demand in a time-dependent manner, thus avoiding waiting times. The 
modeling calculations show that only 70 % of the vehicles in use today would be needed 
to provide New York with the same level of taxi provision it currently enjoys. Further 


Part Ill: Traffic 299 


calculation shows that for a city such as Singapore to maintain comparable levels of 
supply, only a third of the current vehicle stock level would be required. 

Even though it has not been possible to satisfactorily answer questions on traffic-related 
aspects of autonomous driving regarding mixed traffic with normal vehicles, and espe- 
cially with pedestrians and cyclists, the individual chapters anticipate an essentially 
improved utilization of the available infrastructure and a stabilization of traffic flow. This 
will involve multifarious opportunities for enhanced mobility of persons and goods, 
accompanied by a reduction in environmental impact and a clawing back of public space 
for urban living. The conception of robust migration paths for the development of 
transport systems with due consideration of the infrastructure will be essential for a 
successful roll out of autonomous vehicles. In these paths, increasing automation as well 
as its increasing permeation of the whole system must be able to be flexibly mapped. 
Corresponding concepts will be formed for allocation of spaces for autonomous, normal, 
and mixed traffic, and for specific rules for speed, in order to guarantee a high level of road 
safety. 


Traffic Control and Traffic Management 1 5 
in a Transportation System 
with Autonomous Vehicles 


Peter Wagner 


15.1 Motivation 


This paper aims to quantify the effects of autonomous driving on the traffic management 
level. This involves developing a model of autonomous driving that makes it possible to 
use human-controlled and autonomous vehicles with only minor modifications. This is 
important with regard to defining how the instruments of traffic management need to be 
developed in the future to enable them to handle autonomous vehicles in the transportation 
system. Of particular interest in this context is mixed traffic, in which normal and auton- 
omously driving vehicles interact with each other. This will presumably be the normal state 
of affairs on roads for quite some time even after the introduction of autonomous vehicles; 
it is, therefore, of great practical significance to gain a good understanding of precisely this 
situation to predict and prevent any systemic effects that may occur. 

Since such vehicles do not yet exist, portions of the following observations must be 
regarded as an initial appraisal of possible developments presented as a scenario. How- 
ever, modeling of human drivers is likewise far from complete, so the focus in this paper 
will be on establishing consistent modeling. The objective of the modeling presented here 
is to describe, as far as possible, human and autonomous vehicles with the same model, 
distinguished only by the different parameters used. A good example of this is the distance 
to the vehicle ahead expressed in terms of the time gap: an autonomous vehicle can 
achieve times of 0.3...0.5 s [1], whereas vehicles driven by humans are legally required to 
maintain a distance of at least 0.9 s (in Germany). The legal recommendation is actually 
2.0 s, but this is seldom maintained except when traffic volumes are low. In heavy traffic, 
the value is often significantly lower; the figure for heavily traveled autobahns that occurs 
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most often is 1.1 s (see Fig. 15.3), with an average value of 1.4 s. If drivers complied with 
the legally stipulated specifications, traffic on many roads would come to a standstill much 
earlier than is currently the case. 

This paper builds on the papers by Friedrich [2] and Pavone [3] in this book. While [2] 
describes the general effects of autonomous vehicles on the transportation system, this 
paper addresses the modeling of autonomous and human-driven vehicles as well as the 
effects of autonomous vehicles on traffic management. Paper [3], by contrast, largely 
ignores questions of traffic flow and traffic control and focuses primarily on the optimal 
allocation of supply in relation to demand based on the premise that vehicles can be 
shared. We can quite rightly conclude at this point that a combination of these approaches, 
together with a correct description of the share of travelers who would opt for trans- 
portation via a robotic “mobility-on-demand” system, allows the best possible appraisal of 
the potential of autonomous vehicles. 

The paper also does not consider effects that would result from a fundamentally dif- 
ferent organization of transportation. One example of this would be the EU’s CityMobil 
project, in which such scenarios are discussed and examined in greater detail [4]. 

This paper will examine how autonomous vehicles affect typical traffic management 
applications by looking at a few examples which have not been developed in all specifics. 
These examples, in order of increasing complexity, are the simulation of a single traffic 
signal system (Sect. 15.4), simulation of an intersection controlled by an adaptive traffic 
signal system (Sect. 15.5), simulation of a green wave (Sect. 15.6) and the simulation of 
an entire city (Sect. 15.7). 

Some of the questions to be considered here can draw on the effects of the introduction 
of intelligent speed control (autonomous intelligent speed control—AIC) on traffic flow on 
highways in particular [5]. There is a great deal of literature on this subject; the disser- 
tation [5] and parts of the book [10] provide a more in-depth overview than is possible in 
this chapter. 

One such AIC scenario is highly similar to Use Case #1 “Interstate Pilot Using Driver 
for Extended Availability”, which in turn (from a traffic-flow standpoint) is a special 
variant of Use Case #3, “Full Automation Using Driver for Extended Availability”. This is 
also the use case that plays the most important role in this chapter, notwithstanding the 
fact that it is rather irrelevant from the traffic-flow standpoint whether the driver is 
available or not. The availability of the driver could be important if the impact of failures 
on traffic flow was being examined, but this topic will not be addressed in this book. This 
would require detailed statistics regarding how frequently something of this sort occurs 
and under what circumstances—information which is not available at the current stage of 
technology of autonomous vehicles. The Use Cases #2 (Autonomous Valet Parking) and 
#4 (Vehicle on Demand) play only a minor role in this chapter, although Use Case #4 
should be treated like Use Case #3 from a traffic-flow standpoint. Use Case #2 would be 
interesting because it has an influence on parking search traffic and thus indirectly on 
traffic demand and thereby also traffic control, but on the traffic management level it 
would require a significantly more complex approach than can be achieved here—it would 
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require, for example, a precise quantification of the parking search traffic in a city. Even 
the simulation of the city of Braunschweig described in Sect. 15.7 assumes that vehicles 
that have reached their destinations always immediately find a parking spot. 


15.2 A Model of Driving 


Models that describe how a human drives a vehicle have been around for a long time [6]. 
Very many of these models (for an overview see [7-10])— since 1950 more than 100 
models have been described solely for the process of following a vehicle driving ahead— 
can also without further ado be applied as models for autonomous vehicles, albeit with 
differing parameters for humans and machines as mentioned in Sect. 15.1. It is thus 
conceptually quite simple to model mixed traffic and quantify its effects on the trans- 
portation system as a whole. 

In the following, the focus will be on the process of following a vehicle, which is the 
most important, but not the only relevant process that determines the development of 
traffic flow on roads. 

Every vehicle is described by its position x(f), which depends on the time r and is 
defined in relation to some reference (e.g. the beginning of the current section of road), by 
its velocity v(t) and its acceleration a(t); see also Fig. 15.1. In multi-lane traffic, the lane in 
which the vehicle is driving—the lateral coordinate, or distance of the vehicle from the 
edge of the road—comes in as a variable as well. Ideally each vehicle should also be 
indexed; this is circumvented in the following by describing the vehicle driving ahead 
with uppercase letters X(t), V(t), A(t). With the additional variables gap g(t) = X(t) — 
x(t) — £ and difference in velocity Av(t) = V(t) — v(t) (see also Fig. 15.1), the reaction of 
the following vehicle can then be defined as the acceleration that the vehicle applies in a 
particular situation: 


PELIPE E TET, (15.1) 

dt 
This abstract Eq. (15.1) could be abstracted even further; lacking, for example, are 
models for driver errors and fluctuations as well as the modeling of a reaction time. 
A corresponding error model is introduced in Sect. 15.3, although reaction time, a 
notoriously thorny construct, is excluded entirely. While measurement data does very 


Fig. 15.1 Visualization of the applied dynamic variables using a SUMO [19] screenshot. The 
traffic direction is from right to left. Image rights: copyright resides with author 
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frequently show that the acceleration of a following vehicle lags approximately 2 s behind 
the acceleration of the vehicle driving ahead, there are also cases in which the following 
vehicle starts braking approximately 1 s before the leading vehicle—for example when 
approaching a traffic signal (traffic light). In the following, we will examine the abstract 
Eq. (15.1) with greater specificity. For example, one important question for the following 
observations is how precisely an autonomous vehicle moves. Surprisingly, many of the 
current adaptive cruise control systems and also published control algorithms work for 
automatic vehicles [11-13] as linear control systems: 


ù= a(g — g*(v)) + BAv (15.2) 


Typical parameters for the two time constants are represented by « = 1/20 1/s* and 
ß = 1/1.5 Vs; with these values, cruise control systems are configured in a way that is 
perceived by drivers as agreeable and natural [14]. For the preferred gap g*(v) = vt, as a 
tule the legal regulation is applied, albeit with a somewhat smaller value for the preferred 
time gap T, e.g. T = 1.5 s, which is also used in the rest of this chapter. The model in 
Eq. (15.2) was originally introduced in Helly 1959 [15] as a model describing a human 
driver. This underscores the assertion that many driver models and the models for 
autonomous driving are mathematically very similar. Where they differ will be discussed 
in greater detail in Sect. 15.3. 

The model in Eq. (15.2) has limits. For example, it is crash-free only for particular 
parameters (x, 8), and is only string stable for a small subset of parameters. String stability 
is the ability of a chain of vehicles driving behind each other not to succumb to the “slinky 
effect” and jam up: for instance, when minor braking by the first vehicle in the chain leads 
to an amplified effect along the chain, in extreme cases actually causing a vehicle in the 
chain to come to a standstill. Or causing a traffic accident. To date, this behavior has only 
been found in very specific situations (see [21] for an example)—it does not appear to be 
the normal case. 

However, the parameters with string stability are not perceived as very agreeable by 
human drivers, so AIC systems generally apply a compromise solution that results in a 
weak string instability [14]. 

For that reason, this paper looks at a different approach in the tradition of the models in 
[16-18]. A first step considers that an important condition for safe driving is fulfilled when 
the following applies: 


d(v) +vt<D(V) +8. 


In this equation, D(V),d(v) are the braking distances of the leading and following 
vehicles. Obviously this model is predicated on the following driver having an idea of 
whether and how the leading vehicle will drive or brake. That is certainly not entirely 
adequate; and yet driving does work in many cases on the assumption that the other 
drivers will behave more or less as one does oneself. 
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However, that also means that the approach flowing from this and the following 
equation can be tricked by “strange” behavior on the part of the leading vehicle. If the 
leading vehicle has an autonomous emergency braking system that allows deceleration 
values of up to 12 m/s”, it violates the assumption of similar behavior to the following 
vehicle—typical deceleration values for a human driver are in the range of up to max. 
4 m/s’—leading to a much shorter braking distance. This can be compensated for to some 
extent, as the following simulation results also show, because the equations resulting from 
this approach in the case of strong braking by the leading vehicle can exceed their own 
deceleration. At the same time, this approach is one that could find further application in 
the development of driver models for traffic safety. 

The above model can be developed further by stipulating that the safety condition be 
fulfilled not at the current time 7, but also for a certain time ¢ + T in the future. The time 
T is the anticipation time, i.e. the length of the planning horizon of the driver. With the 
notation x’ as a short-hand for the value of the variable x at the time ¢ + T, the safety 
equation becomes: 


d(v’)+vV't<D(V') +g. 


But this equation can now be reformulated according to acceleration a. Thus x’ = 
x-+vT + aT? /2 and together with an approach for the braking distances d(v) = v?/(2b), 
the safety equation can be solved for a. There are various approaches for this; here 
primarily the following exact approach is pursued: 


v= L (c+ T/2) + P+ T) + V2 + 2bvT + 2b(g + AvT) — v) . (15.3) 


Interestingly, this approach for T — 0 leads back to the one used in SUMO [19]. 

Another possibility, following [17], is a Taylor expansion of 
d(v') = d(v+aT) ~ d(v)+aTv/b(v), which, interestingly, leads to a linear equation for 
a which is simpler to solve and numerically less complex: 


V? — v? +2b(TAv +8 — vt) 
T(2bt + bT + 2v) 


a = 


Although these equations look complicated, and it is rather unlikely that people can 
actually extract a root from a complex expression while driving, graphically it does 
strongly resemble the Helly model. This is interesting because it is indeed quite easy to 
imagine that a human driver is capable of carrying out a linear consideration along the 
lines of “I’m moving somewhat faster than the person in front of me, but the gap is large, 
so there is no immediate need to change anything.” An idea of how this acceleration 
function looks for realistically selected parameters is provided by Fig. 15.2. 
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Fig. 15.2 Representation of the acceleration functions. Rather than drawing the entire function 
here, only the area delimited by two lines in the (Av,g) range is represented, in which the 
acceleration of both models is small. To the left of the lines, the vehicle is braking, to the right it is 
accelerating. The figure on the left is the model from Eq. (15.3), the one on the right the Helly model 
(15.2). The selected parameters are V = 20, t = 1.5, b = 4, T = 2. Image rights: copyright resides with 
author 


In this context it is also interesting to know whether this approach is indeed free of 
collisions. The simple answer is no. Under some circumstances, the dynamic that follows 
from Eq. (15.3) can indeed be fooled. This can be demonstrated by a chain of vehicles 
following a leading vehicle that is driving according to a specific protocol ao(t). The 
salient parameters in the dynamics of the leading vehicle are primarily the maximum 
accelerations. Of particular interest here are the maximum decelerations and the question 
as to whether it is possible to produce a collision with the model. 

Of course, no procedure can really test all eventualities. But the following approach 
does at least allow an estimation of how secure the models are. In a simulation, n = 50 
vehicles follow a leading vehicle that selects its acceleration according to a specific 
protocol. Among other things, it repeatedly decelerates to a standstill, in some cases with 
decelerations at the limits of current driving dynamics capabilities. Studies on this set-up 
very quickly revealed that collisions can only be avoided in the models when the antic- 
ipation time T during braking is set to a lower value. In the following the models are 
always operated with T = 2 s in normal driving, and with T = 0.5 s when braking. 

The respective simulations then show that, under these conditions, no accidents occur 
with the model in Eq. (15.3), at least not with the selected protocol ao(t). The Helly 
model, however, is not so tolerant with the selected parameters and occasionally produces 
rear-end collisions. 
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15.3 Man Versus Machine 


At this point the question arises as to what actually distinguishes a human driver from an 
autonomous vehicle. Heretofore just one significant difference has been established, and 
that is the time gap t with which the two drive. Humans should not drive with a gap of less 
than t = 0.9 s, and the legal recommendation is actually t = 2 s; in principle, a machine 
can drive with a t = 0.3...0.5s gap [1]. An example analysis of the actually maintained 
gaps (see Fig. 15.3) on a German autobahn (with speed around 100 km/h, where the 
greatest traffic volumes are achieved) shows that (very) few human drivers approach this 
“ideal”, whereas the overwhelming majority demonstrates legally compliant behavior. 

Figure 15.3 also shows that human behavior covers a broad spectrum which stands in 
contrast to autonomous vehicles: they would all drive with a small and very similar value 
of t. This spectrum can be characterized [20] and quantified in greater detail. In general it 
can be said that t not only varies between different drivers, but indeed is not even 
consistent for the same driver. Unfortunately t is not precisely observable, in particular 
when the leading vehicle itself constantly changes speed, so it is only possible to posit 
assumptions as to how Tt varies over time. This then leads to 2D models [20, 21], in which 
t varies in each time step. A simple scenario that leads to such a dynamic is the driver 
misjudging the gap. However, this error is time-correlated, i.e. when the estimated gap at a 
certain point in time is smaller than the actual gap, this will continue to be the case for a 
certain period thereafter as well. And there is a reasonable probability that the error will be 
asymmetrical: Gaps are frequently estimated to be significantly smaller than they actually 
are. Such a modeling approach does in any case lead to a very broad spectrum of t values, 
just as is observed empirically. 

A second point in which a human differs from a machine is what is known as the action 
point mechanism [22]. Strictly speaking, a human driver cannot be described by a dif- 
ferential Eq. (15.1). Rather, a vehicle is controlled through correction of the acceleration 
(accelerator-pedal position) at irregular time intervals, as shown in the example Fig. 15.4. 


p(t) (1) 


00 02 04 06 08 


t(s) 


Fig. 15.3 Gap behavior in the left lane of the A3. Displayed is the density of the respective time 
gap. The maximum of the function is more or less precisely 1.1 s, while the average is 1.4 s. Some 
dangerously short time gaps are observed, too. Image rights: copyright resides with author 
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Fig. 15.4 Acceleration as a function of time with a human driver. It can be seen that the 
acceleration changes erratically at the action points. Between the action points, it remains nearly 
constant. The data was recorded in a “drive” by the author with a driving simulator; similar images 
can be found in all data records with sufficiently accurate measurement of the acceleration or 
accelerator and brake pedal. Image rights: copyright resides with author 


The time gaps between successive action points also demonstrate a very broad dis- 
tribution, with values between 0.5 and 1.5 s. Here there is evidently another modeling 
approach for traffic safety questions—if the time between two action points becomes very 
long, a critical situation can arise. In normal cases that does not occur, however, and there 
are only minor variances between a model based on Eq. (15.1) and a model in which the 
action points are explicitly used [23]. In particular, the action point mechanism alone does 
not lead to a wide distribution of gaps between the vehicles. 

This too is demonstrated in the example used in Sect. 15.2 of the chain of vehicles 
following a leading vehicle. An evaluation of the gap measured (in the simulation), here as 
a function of the number of the following vehicle, shows that in most cases an autono- 
mous vehicle follows the leading vehicle with significantly less variance—in spite of the 
sometimes extremely volatile behavior. A representation of this is found in Fig. 15.5. 
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Fig. 15.5 Gap size behavior for human and autonomous vehicles. The graphic shows the average 
gap and the 25th and 75th percentiles, in each case as a function of the position in the chain. The 
upper curve is for the model of the human driver and the lower one models a chain of autonomous 
vehicles. Image rights: copyright resides with author 
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Thus the models used in this chapter have been specified, and the difference between 
the human and the autonomous driving style has been characterized. The rest of this 
chapter will utilize various applications to illustrate what that means for typical traffic 
management applications. 


15.4 Approaching a Traffic Signal 


This process is one of the candidates in which autonomous vehicles promise significant 
benefits. In an approach to a traffic signal, the following examines the delay d per vehicle 
for a random combination of normal and autonomous vehicles. Here, n describes the share 
of autonomously driving vehicles, whereas t = 0.5s is assumed for autonomous and 
t = 1.5s for normal vehicles. The simulation results are also supported by a theoretical 
consideration. There is a theory for the described situation which was developed in [24]. 
Interestingly, the theory can be applied to a situation with a mix of autonomous and 
normal vehicles. Then the respective expression is: 


d( yey 1 sale re GE ‘cee (15.4) 
qs" 2 1-y olay o> ae aon S0 n sın 2 


In Eq. (15.4), q is the demand, so the capacity of a flow of human-guided vehicles, sı 
the capacity of a flow of automated vehicles, g the green time and c the cycle time of the 
traffic signal. The cycle time is the time it takes for the traffic signal to regain the same 
state it had at the beginning. The simulation results for selected variations in demand 
(q) and the share of autonomous vehicles 7 is shown in Fig. 15.6. 

The curves in Fig. 15.6 were recorded by simulating various values of demand 
q (varying from 18 to 1800 veh./h) for 5 h each. The demand itself is a stochastic variable 


Delay (s/veh) 


0.0 0.1 0.2 0.3 0.4 0.5 
Demand (veh/s) 


Fig. 15.6 Delay at a traffic signal as a function of the demand and for different equipment rates 
n = 0, 20, 40, 60, 80 and 100 % (from left to right). The dotted lines were calculated from Eq. (15.4), 
albeit with a capacity, which was measured directly in the simulation. Image rights: copyright 
resides with author 
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(approximately Poisson-distributed), i.e. in each observed time interval, there is always a 
different number of vehicles and only the average over many such time intervals leads to 
the correct demand. 

The delay was recorded for each simulated vehicle and the values used to calculate the 
average entered in Fig. 15.6. In principle, the entire distribution of delays can be used to 
characterize the results, which for reasons of space is omitted here, although it would be 
interesting. The fluctuations in the delays are a measure of the reliability of such a system. 
However, the example presented here shows that the delay fluctuations are only very 
weakly correlated with the proportion of autonomously guided vehicles; the major source of 
stochasticity in this system is generated by the demand and not the dynamics of the vehicles. 

Two results in Fig. 15.6 stand out. For one thing, the description from the theory does 
not always correspond to the simulation results. A considerable amount of research is still 
needed here, because it’s not at all simple to translate the assumptions on which the theory 
is based into the simulated reality. This will undoubtedly be even more difficult in 
comparison with real measured values. To achieve agreement, the values for the 
saturation-traffic volume determined in the simulation had to be used—with the theoretical 
values, i.e. the r values defined in Sect. 15.3, the agreement is not compelling. 

Second, autonomous vehicles “only” change the capacity; otherwise there are no or 
only very small gains. As long as the demand stays away from the respective capacity, 
there are only minor differences between the various scenarios, at least on the level of the 
description selected here. 

A change in the capacity does have one very positive effect, however: it means that the 
required green times at a traffic signal can be shorter, leaving more time for other modes of 
transport. 


15.5 Adaptive Traffic Signals 


Section 15.4 looked at a traffic signal with a fixed-time control system. Many modern 
systems, however, utilize an adaptive control system. That means that the traffic signal 
attempts to coordinate its green times with the current demand. When demand is low, the 


Fig. 15.7 Green times (left) g = 4 
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simulated adaptive system, Bo | = 2 4 
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green times are short, and when demand is high, the system responds with long green 
times. The details are somewhat more complex, because the delay regarded as a function 
of the demand has a minimum with a certain optimal cycle time. An adaptive system is 
able to choose the optimal cycle time for itself, and makes very clever use of the fluc- 
tuations that occur in the traffic flow. 

In this case as well, the aim is to examine how such an adaptive system handles a mix 
of autonomous and normal vehicles. To this purpose, simulation of a two-armed inter- 
section controlled with an adaptive method was set up [27]. The two arms are 600 m long, 
and the delay per vehicle at intersection is measured. In contrast to Sect. 15.4, however, a 
demand was selected that depends on the time and thus replicates a peak hour group in 
which at the time of maximum demand the system is saturated in spite of its adaptivity. 
The demand function selected here is: 


7 TÉ 
q(t) = qo + qı sin (7), 


where go is a basic load, q; is the amplitude of the demand fluctuation and T is the entire 
time period of the simulation. Both arms are subjected to the same demand, which 
represents a relatively unfavorable case. 

Beyond the delays, in this case it is primarily the green times that are of interest. Since 
the system adapts the times to the demand, they fluctuate within typical ranges. In many 
countries, the green time cannot fluctuate freely: for instance, the green time for a normal 
traffic signal cannot sink below 5 s, and in the following simulations, the maximum green 
time is set to 40 s. 

Such a simulation is also an interesting case in the evaluation of the simulation data. 
A single simulation of such a peak hour shows major fluctuations in terms of delays as 
well as green time and cycle times. Although the delays were averaged over a cycle of the 
system, that in itself is not sufficient because the cycles are themselves stochastic variables 
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Fig. 15.8 Delay as a function of the offset time for a simple green wave. Depicted here is a 
simulation with human drivers (gold) and one only with autonomous vehicles (blue). Shown here is 
the best result achieved between the first and second intersection. Image rights: copyright resides 
with author 
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whose average values and statistics can only be determined through a sufficient number of 
repetitions of the same scenario with slightly different details—just as in reality when 
successive days are examined. To obtain statistically valid results, in this case the peak 
hour was repeated 50 times. At 5-min intervals, the averages of the delays over the last 
cycle and the corresponding green times set by the system were collected. The results in 
Fig. 15.7 were composed from this data. 

With maximum demand, the system extends the green times up to the limit of 40 s and 
thereby demonstrates that it has reached its saturation level. However, this only applies for 
a flow of normal vehicles. As soon as autonomous vehicles are added to the mix, the top 
delay value for sinks and with an equipment rate of 50 %, the maximum green time is not 
even reached. This lines up with the observation in Sect. 15.4 that autonomous vehicles 
not only increase the capacity, but also contribute to a reduction in green times—an effect 
that is rather clear in this example, namely that even a small proportion of autonomously 
guided vehicles can make a noticeable impact. 


15.6 Green Wave with Autonomous Vehicles 
The previous scenarios examined a single intersection. Much more interesting is the case 


of a stretch of road with multiple intersections in succession which are all controlled by a 
traffic signal system. In this case the coordination between the traffic signals, known 
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Fig. 15.9 Excerpt of the simulation network for Braunschweig. The land use data comes from the 
openstreetmap dataset [26]. Image rights: copyright resides with author 
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colloquially as the green wave, plays an important role. Here again, a simulation is used to 
investigate how great an impact the introduction of autonomous vehicles has. Analogous 
to the procedure in [28], a section of road with 10 intersections is simulated with varying 
coordination configurations. The demand, which is constant, the green times and the cycle 
times remain unchanged. The only change is to the offset, i.e. the point in time at which 
the traffic signal turns green for the vehicle flow in a particular direction. If this offset 
between two signals is precisely equal to the travel time between the two signals, the 
system is in its optimal state: the delay for the vehicles at the downstream signal is exactly 
zero when the green times are equal. In that case, just as many vehicles can cross the 
intersection as left the upstream traffic signal. 

The expectation is clear: In this case, no improvements will be achieved with an 
autonomous vehicle; and that is precisely what the simulation results in Fig. 15.8 
demonstrate. However, autonomous vehicles do indeed improve the delay times in the 
case of sub-optimal coordination. The reason is that the bunch of vehicles that leaves a 
traffic signal is more compressed than with human drivers. 


15.7 Simulation of a City 


This final section will examine how the introduction of autonomous vehicles might impact 
an entire city. To this purpose, an existing SUMO simulation [19 25] of the city of 
Braunschweig is used to simulate the impact of autonomous vehicles on the traffic flow of 
a transportation system. 

However, the model introduced in Sect. 15.2 is not implemented in SUMO, so the 
simulation has to be carried out with the models that are available in SUMO. The sim- 
ulation therefore uses the standard model integrated in SUMO, which in terms of 
describing the fluctuations of the drivers is not as refined as the model introduced here. 
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Fig. 15.10 Comparison of the delays for a simulation with human drivers (gold, upper curve) and a 
simulation in which the passenger vehicles drive autonomously (blue, lower curve). Each data point 
is a floating average value from the 8 adjacent one-minute values. The dispersion of the values of the 
two curves is not very different and is therefore not displayed. Image rights: copyright resides with 
author 
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To set up the model, a modified network by the NavTeq company is used; an extract of 
the transportation network is seen in Fig. 15.9. The full simulation comprises the entire 
area of the city of Braunschweig, including the autobahns in the area. The simulation 
network comprises approximately 129,000 edges. 

The required traffic demand comes from a start/destination matrix from the PTV 
company, which is available for different days of the week in 24 time slices of one hour 
each for each of those days. This demand was used to calculate a user equilibrium, which 
in this case required some 100 iteration steps. At the end of this process, for each vehicle 
simulated in SUMO there is an optimal route in the sense that every other route through 
the network would take longer. A total of 647,000 vehicles were simulated. Initial 
comparisons with real data from Braunschweig suggest that the matrix significantly 
underestimates the demand. This undoubtedly affects the results discussed here, but it was 
not possible to carry out such corrections in the context of this project. 

To simulate autonomous vehicles, a new vehicle type is introduced which has similar 
parameters to the models in Sect. 15.2: the autonomous vehicles in SUMO drive with 
t = 0.5 s, all others with t = 1 and ø = 0.5. o is the noise parameter in SUMO, i.e. it 
indicates by how much a vehicle deviates from the optimal driving style. The selection of 
t = 0.5 s means that the time-step size in SUMO also has to be set to 0.5 s to ensure that 
the vehicles can continue to drive without colliding. This extends the simulation time from 
around 50 min to 90 min for the simulation of an entire day in Braunschweig. 

Only the passenger vehicles were simulated as autonomous vehicles; the approximately 
44,000 trucks remained unchanged. The traffic signals were likewise not entirely correctly 
represented in the simulation. It may therefore be assumed that on this end as well, further 
corrections to the simulation results below can be expected. 

Nevertheless, this simulation delivers significant preliminary results, as seen in 
Fig. 15.10. Even without further measures, the autonomous system is more efficient in the 
sense that it reduces delays between 5 and 80 %, with an average value of around 40 %. 
With the selected parameters, however, the variance in travel times changes relatively 
little; the system, in other words, becomes faster, but not necessarily more reliable. That 
could change if the traffic management system were also realistically simulated. Such 
studies are currently in the works. 


15.8 Conclusion 


This paper presents some initial considerations regarding how traffic management needs to 
respond to the opportunities presented by autonomous driving. The case studies presented 
here demonstrate that, depending on the scenario, very different improvements can be 
achieved in the flow of traffic through the introduction of autonomous vehicles. 
Unfortunately, the improvements that could be achieved are difficult to summarize with 
a single number. It was demonstrated in Sect. 15.4, for example, that the capacity of a 
traffic signal can certainly be doubled. If the demand is low at the corresponding signal, 
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this doubling is scarcely noticeable. But if the signal is working at the limits of its 
capacity, by contrast, even a minor increase in its capacity can lead to a dramatic 
improvement. 

This can be observed quite clearly in the scenario in Sect. 15.5: here the demand runs 
the values from very low to (temporary) over-saturation. Although the introduction of 
autonomous vehicles has little impact on green times and delays when demand is low, it 
yields major improvements when the system is operating beyond capacity. Nevertheless, 
the magnitude of these improvements does depend on the details of the scenario being 
examined. If the peak value for demand were just a bit lower, the benefit would also be 
significantly diminished. 

That notwithstanding, it may be asserted with confidence that at least in the urban 
context, the introduction of autonomous vehicles has the potential to generate substantial 
time gains at traffic signals which would then be available for other road users—if the 
introduction of these vehicles does not lead to an increase in demand for automotive 
transportation. 
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The Effect of Autonomous Vehicles 1 & 


on Traffic 
Bernhard Friedrich 


16.1 Introduction 


Objective 

Autonomous vehicles maneuver in traffic through road networks without requiring 
humans as supervisors or decision makers. Autonomous vehicles increase comfort for 
their passengers by removing the need for them to perform driving tasks. Autonomous 
vehicles provide new mobility opportunities for groups of people that thus far have been 
partially or entirely excluded from participation in public life due to mobility restrictions. 

In addition to the benefits that autonomous vehicles potentially provide their users, the 
social benefits that would come with their proliferation are of interest. For it is clear that 
autonomous driving does not lead to a loss of safety or efficiency of road transport but 
rather improves them. This paper considers the traffic impact of autonomous vehicles, 
looking specifically at the efficiency of using the existing infrastructure. 

The efficiency of the transport infrastructure is determined by its capacity. On high- 
ways, the capacity is dependent to a large degree on the maximum possible flow of traffic 
on the road sections as well as the capacity of entry, merging and exit lanes at 
grade-separated traffic intersections. In the city road network, and on country roads with 
through-roads, the capacities at the intersections are the crucial factor and therefore mostly 
dependent on traffic signaling. While the capacity at traffic lights is determined by the 
amount of time required by individual vehicles in the departing lane to pass the node, the 
capacity of highway sections is determined by the instability that occurs at high traffic 
volumes and leads to congestion. 
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In order to understand the various factors that determine the effect of traffic on 
autonomous vehicles, the key characteristics of traffic flow and their interdependent ele- 
ments are the initial focus of this paper. Building on these foundations, we will derive the 
impact of autonomous vehicles on the capacity of highway segments as well as on 
intersections with traffic signals. The impact of autonomous vehicles on the connection 
quality of journeys covering different infrastructure elements cannot be adequately 
described in this model. Nevertheless, these considerations provide a preliminary 
assessment of the potential for optimizing the efficiency of traffic flow that potentially 
includes autonomous vehicles. 


16.2 Characteristics of Traffic Flow 
16.2.1 Parameters of Traffic Flow 


In order to develop a mathematical model of traffic flow, we use an abstraction of the road 
network, the vehicles, the drivers and their behavior. Certain simplifying assumptions are 
therefore made. 

The road network is divided, for example, into road segments and intersections. We 
investigate here, therefore, either road segments or intersections where consistent condi- 
tions, i.e., flatness, sufficient visibility, dry surface, etc. are assumed. With regard to 
drivers and vehicles, it is expected, among other things, that properties such as reaction 
time, willingness to engage in risks and technical proficiency follow an empirically proven 
statistical distribution. 

A distinction is to be made between several ways of describing traffic flow. The 
microscopic model describes the relevant characteristics of a single vehicle i: 


— temporal headway 1;(s) 
— spatial separation x;(m) 
— speed v;(km/h). 


The macroscopic descriptive model takes into consideration many vehicles and the 
relevant properties of a traffic flow: 


— traffic volume q(veh/h) 
— traffic density k(veh/km) 
— mean speed v(km/h). 


The traffic flow can be recorded by measuring the parameters of a particular 
cross-section over a time interval dt by means of so-called local observations or mea- 
surements at a given time over a path interval dx, which are so-called momentary 
observations (Fig. 16.1). 
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Fig. 16.1 A system of local and momentary measurements. Different traffic speeds occur for the 
individual speeds recorded locally or momentarily 


16.2.2 Traffic Flow Theory 


Neither the macroscopic parameters v, q, and k, nor the corresponding microscopic values, 
define in themselves a traffic state. In order to define a traffic state, knowledge of their 
interdependencies is a prerequisite. The three macroscopic quantities, traffic volume, 
traffic density and momentary speed, are dependent on one another according to the 
equation 


q=k-v(k) 


Measurements of traffic volume and mean speed resulted in a detectable decrease in 
speed when traffic volume increases, i.e., with increasing mutual influence of vehicles. 

One of the first models to describe traffic flow on an open stretch road came from 
observations made by Greenshields [1], who researched the relationship between the 
speed v and the traffic density k. With the help of regression analysis, he established a 
linear relationship for v = v(k) 
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VCR) = ve — ena (IK) 


where vp represents the free flow speed and kmax the maximum traffic density. 
Inserted into the equation q = v-k, this results in a parabolic relationship between 
traffic volume and traffic density in the form: 


alk) = ve- (Rn) 


Equations with these parameters are referred to as equations of state and their graphical 
representations are called fundamental diagrams of traffic flow. 


16.2.3 Model for Stationary Traffic Conditions—Fundamental 
Diagram 


The fundamental diagram is a graphical illustration of the equation of state for traffic, i.e., 
the functional relationship between the parameters of traffic volume q, traffic density k, 
and the mean momentary, i.e., section-related speed v, and represents a curve in 
three-dimensional space. The orthogonal projections of the curve onto the planes, each 
spanned by two parameters, result in the familiar fundamental diagram shown in 
Fig. 16.2. The resulting three diagrams enable a variety of information about the char- 
acteristics of traffic flow over a cross section to be depicted and are referred to as the q- 
v diagram, the g-k diagram, and the k-v diagram. 

The fundamental diagram shows that, for the same traffic volume q;, two different 
qualities of traffic flow can occur. The threshold qmax separates for qi < qmax the range of 
high speeds at low traffic densities, i.e., the free and stable flow of traffic, from the range 
with relatively low speeds and high traffic densities, i.e., the range of unstable and 
interrupted traffic flow. Empirical studies reveal that the transition between a stable and an 
unstable traffic state does not run continuously as shown in Fig. 16.2 in idealized form. 
Rather, in case of high traffic load and triggered by disturbances a transition from the 
stable to the unstable range takes place. This transition is associated with a significant drop 
in the traffic volume (Fig. 16.3). In light of these considerations, May and Keller [2] 
characterized three forms of traffic that occur: 


— Free traffic at high speeds and low traffic volumes and densities 

— Partially constricted traffic, up to the range of maximum traffic volumes, optimal speed 
and traffic density 

— Constricted traffic with high traffic densities, low traffic volumes and speeds. 
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Fig. 16.2 Views of the fundamental diagram according to [3]. Source Handbuch für die 
Bemessung von Straßenverkehrsanlagen (HBS), S. 3-19, FGSV 2001 
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16.2.4 Capacity and Stability 


The efficiency of the traffic system depends on the capacity of the traffic infrastructure. 
This capacity is defined as the “largest volume of traffic that a traffic flow can reach at a 
given distance and traffic conditions at the cross-section determined for this flow” [3]. The 
capacity is determined by the density of the platoon of vehicles and the speed with which 
the platoon passes through the cross-section. 

Traffic density is determined by the distances between vehicles. The rule of thumb is 
that the safe distance in meters before the vehicle ahead that a driver should adhere to is 
half the value of the current speed in kilometers per hour. This well-known rule of “half 
speedometer distance” is based on a reaction time of less than 1.8 s, since at this value and 
constant speed, precisely the distance to the preceding vehicle is travelled. This minimum 
distance is also usually required by law (see, e.g., [4]). For trucks, road regulations 
explicitly stipulate that, at speeds above 50 km/h, a minimum travel distance of 50 m 
must be maintained, which requires a time interval of 2.25 s at the maximum speed limit 
permissible for vehicles over 7.5 tons on highways. 

Assuming a reaction time of 1.8 s, the capacity of a lane can be estimated, in a 
simplified model, at about 2000 vehicles per hour. This applies equally to city streets as to 
country roads and highways. However, empirical studies show that the headways are on 
average significantly shorter than 1.8 s and especially at high traffic volumes amount to 
1.0 s. The 15 % percentile of the distribution in these cases is even below 0.5 s (see also 
Fig. 15.3 in the chapter by Peter Wagner in this book [5]). This means that 15 % of the 
vehicles follow a preceding vehicle with a headway of less than 0.5 s. Figure 16.4 shows 
the corresponding headway distributions for different traffic volume ranges and different 
speed limits. 

Due to the short following distances at relatively high speeds, empirical studies also 
investigate capacities that may be significantly higher than the stated 2000 veh./h. Fur- 
thermore, these studies indicate that there is no exact value where traffic flow stops being 
stable and breaks down if this value is exceeded. Rather, it can be observed that the 
capacity is a random parameter that can be represented by a distribution (Fig. 16.5). 
Investigations of many sections of road [6] show that the capacity of highways are 
typically Weibull-distributed and, for example for 3-lane highways, show a standard 
deviation of about 600 veh./h (measured in 5-min intervals) and thus an unexpectedly 
wide variability. 

The expected value of the capacity corresponds in this stochastic depiction to a 
nominal capacity and represents the 50th percentile of that traffic volume amount that was 
the starting point of a breakdown in traffic flow. The closer the traffic load is to, or the 
further it lies above, this nominal capacity, the higher the probability of traffic breakdown 
and traffic congestion. 

Traffic breakdown results in all cases, passing through a transient state of synchronized 
traffic flow to congested traffic. Traffic recovery occurs also via a transient state of syn- 
chronized traffic flow, back to a steady flow of traffic with higher speeds (Fig. 16.6). 


16 The Effect of Autonomous Vehicles on Traffic 323 


headway distribution on the middle lane of a motorway 


T 


q=1200 Kfz/h, Referenz 
reference 1200 Kiz/h, T140 
* * q=1200 Kfz/h, T120 
* = + q=1200 Kfz/h, T100 
reference 1800 Kfz/h, Referenz 
= = q=1800 Kfz/h, T140 
* + © + q=1800 Kfz/h, T120 
* = © g=1800 Kfz/h, T100 
=~ q=2400 Kfz/h, Referenz 
— = g=2400 Kfz, T140 
* * q=2400 Kfz/h, T120 
* = © q=2400 Kfz/h, T100 


cumulated frequency [-] 
o 
a 


0 0.5 1 1.5 2 2.5 3 
Inetto [S] 


Fig. 16.4 Distribution functions of the time gap distribution for different traffic loads and speed 
restrictions [7] 
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Fig. 16.5 Values for 5-min intervals in the qv graph and the related capacity distribution for a cross 
section of a two-lane highway, according to [6] 


The traffic volume also decreases in the transitions to synchronized or to congested traffic 
and a smaller recovery takes place. This effect of a “capacity drop” is caused by the fact 
that drivers, in keeping a greater distance when leaving the downstream traffic-jam front, 
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Fig. 16.6 Pattern of traffic dynamics with the transitions from the state of stable traffic into the 
states of synchronized and congested traffic. The values were measured on a three-lane highway in 
5-min intervals, according to [6] 


maintain a greater distance than before in flowing traffic before the breakdown in traffic 
flow. 

According to [8], this capacity drop is 5-6 %; studies on German highways reported 
values between 4 and 12 % [6]. 


16.3 The Effect of Autonomous Vehicles on Traffic 


The efficiency of the transport system depends on the capacity of a transport infrastructure. 
When a transport infrastructure is used by autonomously driving vehicles, the capacity 
will differ from that of a transport infrastructure used by human drivers. Either the 
capacity of the route sections of the intersections or define the traffic flow. While the 
capacities of the intersections and the traffic signals are relevant to the performance of 
urban road networks, on highways the capacities of open stretches of road are of principal 
importance. For this reason, the following analysis considers the capacity for both cases, 
taking into account that a yet-unknown proportion of vehicles drives autonomously. 


16.3.1 Sections of Highways 


16.3.1.1 Capacity 

The capacity of a traffic lane is determined by the maximum number of vehicles that can 
pass through a cross section per unit of time. It is determined by the density of the vehicle 
platoon and the speed with which the platoon passes through the cross-section. The 
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equation of state that describes the relationship between these fundamental characteristics 
of traffic flow is: 


q=k:v(k) 


In a homogeneous traffic flow, the density is easily determined and results from the 
reciprocal of the footprint of a vehicle [9]: 


1 
k= ; 
vT +L 


In this context, Tp is the temporal distance (time gap) to the preceding vehicle and L is 
the length of a vehicle. Since the capacity represents the maximum traffic volume max» 
this is consequently a function of v, Th, and L. If only human drivers control the vehicle, 
the capacity C, results, with: 


v 
C = r = ——, 
h dmax vT, FL 
Analogously, the capacity C, is described in a traffic flow that purely consists of 
autonomous vehicles by the following function, where T, represents the time gap pre- 
ferred by autonomous vehicles. 


V 
Ta +L’ 


The ratio of the two capacity values and hence the change in the capacity is determined 
by the relation 


Calc, = (VT, + L)/(vTa + L). 


In order to evaluate the effect of autonomous vehicles on capacity values, values are 
used for the parameters of the capacity formula that are empirically demonstrated for 
today’s conditions. So it seems reasonable to assume as the mean speed at which the 
capacity is reached the value v = 80km/h(22.2 m/s). For the footprint of an average 
passenger car, the broadly accepted mean vehicle length is 4.5 m and the minimum safety 
distance to the vehicle ahead is 3.0 m, thus Lear = 7.5 m is used. The mean length of a 
truck is estimated to be 18 m, which is the weighted average of the lengths of a truck 
(18.75 m) and of a semi-trailer (16.50 m). For the footprint of a truck, assuming that a 
3.0 m distance is kept before the vehicle ahead, Luck = 21 m. As a reasonable value for 
the mean following distance at high traffic volumes, the empirical studies provide a value 
of T, = 1.15s. 

For the change in capacity for autonomous driving, the changed time gap Ta for the 
following vehicle is the deciding factor. A technically feasible and, at the same time, 
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Fig. 16.7 Capacity increase that, depending on the speed, would result in an exclusively 
autonomous vehicle fleet (only passenger cars) 


acceptable value from the perspective of road users appears to be 7, = 0.5s. Depending 
on the traffic conditions, this very short following distance already occurs in up to 20 % of 
all following distances. This distance therefore seems acceptable provided that safety is 
ensured from a technical perspective. 

For the assumed values, the capacity and thus the maximum flow rate in the case of 
purely autonomous traffic would significantly increase using the formulas derived above 
(factor 1.78) (Fig. 16.7). 

Compared to today’s observed capacity values of a lane of 2200 veh./h, an increase of 
traffic volume to about 3900 veh./h would thus be possible with purely autonomous traffic. 

If heavy traffic is included in the traffic flow, the mean footprint of the vehicles can be 
deduced from a sum that is weighted with the proportion of heavy traffic w. The traffic 
density is obtained in turn from the reciprocal of the mean footprint of a vehicle with 


1 


k= . 
(1 — œ) (vTr + Lpkw) + @(vT, + Liew) 


For this capacity, the following correlation arises 


v 


C= : 
(1 — œ)(vTa + Lew) + @(vVT, + Liew) 


If one assumes a moderate speed of 80 km/h for autonomous traffic on German 
motorways, we obtain the functional relationship shown in the following Fig. 16.8. If 
trucks make up 15 % of traffic, which is typical on German motorways, a capacity of 
about 3877 veh./h would be achieved, which is almost twice the value compared to 
today’s empirically proven capacity. If, for the sake of a plausibility check and with 
otherwise unchanged parameters, one inserts 7, = 1.15s into the capacity formula, this 
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Fig. 16.8 Capacity of a lane in purely autonomous traffic in relation to the share of trucks 


results in a capacity of about 2280 veh./h for a heavy traffic share of 15 %. This value 
corresponds to the measured capacity at present conditions and confirms the right choice 
of the computational approach as well as the parameters. 

In mixed traffic, where autonomous vehicles are represented by a share of 7 in the total 
volume, the capacity C, is additionally dependent on percentage 1: 


vV 
~ nvTa+ (1 — n)vTn + Lew 


m 


If one inserts realistic values into the equation here, again with v = 80km/h and 
Lear = 7.5 m, the correlation shown in the following graph results (Fig. 16.9). From the 
graph, it is clear that the capacity increases more slowly at lower numbers of autonomous 
vehicles. At 7 = 0.5 capacity only reaches a value of about 3100 cars/h, and thus 36 % of 
the increase that would be possible if all vehicles were autonomous. 
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Fig. 16.9 Capacity of a lane in proportion to the share of autonomous vehicles for pure passenger 
car traffic 
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If one also takes into account that autonomous vehicles should allow an additional 
distance to a vehicle steered by a human driver so as not to harass these drivers, it is 
slightly more complicated to determine the capacity. In this analysis, the combinations of 
successive vehicles (a-a, a-h, h-a, and h-h) and the corresponding time gaps (Taa, Tan, Tnx) 
must be considered in order to arrive at a modified capacity equation: 


v 
"PVT oq +N — n)vTon + (1 — n)vT i + L` 


As realistic values for the headways, the values Taa = 0.5 s, Tan = 0.98, Thx = 1.158 
can be used. In this analysis, the capacity increases in proportion to the share of auton- 
omous vehicles a little more slowly in the lower range and reaches for 7 = 0.5 a value of 
2850 veh./h on the way to achieving a capacity value of almost 4300 veh./h where 100 % 
of vehicles are autonomous (Fig. 16.10). 

The same procedure can be used to estimate the capacity for pure heavy-vehicle traffic 
that could be organized on a single lane of a highway. Not changing our assumptions for 
the required time gaps, a required space of L= 21m is again assumed. For purely 
autonomous driving, these input values result in a capacity value of 2420 trucks/h, 
compared to a capacity value of 1720 trucks/h as achievable for human drivers. 


16.3.1.2 Stability 

Besides the capacity that equates to the greatest traffic volume that a traffic flow at given 
road and traffic conditions at a cross-section can achieve, the stability of the traffic flow is 
an important factor in its efficiency. This becomes clear when the capacity is considered as 
a stochastic variable that represents the probability of traffic breakdown as a function of 
traffic intensity. The greater the standard deviation of the probability distribution, the 
greater is the likelihood of traffic breakdown at lower traffic volumes and thus instability. 
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Fig. 16.10 Capacity of a lane in relation to the share of autonomous vehicles for pure car traffic, 
taking into account larger time gaps for autonomous vehicles following vehicles driven by people 
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If breakdown occurs, capacity is reduced by the effect of “capacity drop” noticeable at 
the magnitude given in the above literature—by about 10 %. Given the same number of 
lanes and same traffic framework conditions (traffic volume, proportion of heavy traffic), 
different spatial and temporal factors result in different capacity distribution functions. The 
key factors in this regard are the speed and the time gap distributions. The smaller the 
standard deviation, the more stable the flow of traffic will be, and the fewer breakdowns to 
be expected at high traffic volumes. 

Especially when autonomous vehicles are able to anticipate the actions of preceding 
vehicles through communication, they can contribute to a stabilization of traffic flow and 
thus to stability. In purely autonomous traffic, it is to be assumed that full stability will be 
achieved and a capacity drop avoided. 


16.3.2 Intersections with Traffic Lights 


Since intersections as part of streets with high traffic are usually controlled using traffic 
signals, the following considerations relate to the capacity of intersections with traffic 
signal control. 

At high traffic loads at intersections with traffic lights, constant queues of traffic occur 
independently of the coordination of the traffic signals. This is why it is usually the case 
that the waiting queue of vehicles, once permitted by the green light to move, starts 
moving from standstill. When the first vehicle has departed at a green light, the next 
follows once a certain time interval has lapsed. This time interval is represented by the 
value of the time variable, which for standard conditions (no slope, traffic travels in a 
straight line, lane width is adequate) and pure passenger car traffic amounts to tp = 1.8 s 
[10]. This corresponds to a saturation flow of qs = 2000 cars/h. The value for trucks and 
buses is tp = 3.15s, and t, = 4.5s for semi-trailer truck. 

At the start of the column of traffic, the time at which departure occurs can be antic- 
ipated from the movement of vehicles ahead. Thus the response time to the departure of 
the driver directly in front is reduced and can be assumed to be 7), = 0.65. At a vehicle 
length of 4.5 m and a distance of 3.0 m from bumper to bumper, an average footprint of a 
car in the traffic backlog in front of a traffic light may be assumed to be 7.5 m, and 
plausible values for the average speed at the stop line of the traffic signal to be 
v= 22.5km/h. One can thus confirm the required time interval via the relation 
th = T, +L/v = 1.88. This applies equally to the amount of time required by trucks and 
semi-trailer trucks with lengths of 12 and 18 m respectively. Consequently, the saturation 
flow of a lane at a traffic signal can be given by the equation of state: 


_ yV 
~ yT, +L’ 


gs 
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To analyze the saturation volumes of purely autonomous and mixed traffic, the cor- 
relations used here are those derived for the capacity of road sections with assumed values 
for queues starting at traffic signals of 22.5 km/h = 6.25 m/s, Tn = 0.6 s. For autonomous 
driving, it is assumed that the reaction time or the safety margin, even in dense and slow 
urban traffic, should not fall below Ta = 0.3 s, Taa = 0.38, Tan = 0.68, Thy = 0.68. 

The capacity of a lane at intersections with traffic lights is, on the one hand, determined by 
saturation traffic volumes and, on the other hand, by green intervals. Green intervals that are 
allocated to different traffic streams over the period of one hour are themselves affected by the 
cycle times and the clearance intervals. During rush hours, a cycle time of 90 s is usually 
chosen, meaning that there are forty clearance intervals within an hour. For a typical road 
junction situated on an urban main street, a three-phase signal program is normally used. The 
clearance intervals used for the main traffic direction in the three phase-transitions typically 
add up to around 20 s and are essentially dependent on the clearance times of crossing 
pedestrians. With a cycle time of 90, 70 s remain for the green light intervals of the various 
traffic flows. If one assumes that, from the remaining green interval, 50 % of the time is 
available for the traffic flows in the main direction, within one hour a release time of 1400 s 
and a release time share of pr = 38.89 % results, i.e., a share of approximately 40 %. 

In conflict-free signaling (i.e., there are no conditional compatibilities, e.g., with 
pedestrians crossing parallel to the main traffic), the capacity of mixed traffic flows is 
determined using the above approach. 


vV: DF 


Cisa = qs : PF = — ~~. 
LSA ds ` PF +L 


In current traffic conditions where vehicles are exclusively controlled by humans, when 
using the above values a capacity of about 800 cars/h per lane results. In purely auton- 
omous traffic with T, = 0.3 s, the capacity would increase to about 1120 cars /h and thus 
increase by about 40 %. For a mixed composition of traffic flows, the efficiency gains are 
between these stated values and can be determined with the formulas introduced above. 

The formula also makes it clear that, in addition to the duration of the time delays of 
following cars, it is especially speed that determines capacity (Fig. 16.11). With 
increasing clearance speeds, capacity grows with autonomous traffic at a higher rate than 
that of traffic with human drivers. If it is possible, therefore, to achieve faster departure 
times and clearance with autonomous driving, as well as shorter time delays, then a 
significantly higher capacity gain than the 40 % named above can be expected. 


16.3.3 Assessing the Efficiency Gains from Autonomous Driving 
Estimates of the effect of autonomous vehicles on capacity as a measure of the efficiency 


of transport systems show significant potential for increasing traffic flow, both on some 
sections of highways and intersections of major urban roads. 
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In city traffic, a capacity increase of about 40 % could be achieved with purely autonomous 
traffic, while capacities could be increased on highway sections by about 80 %. The signif- 
icant difference in the growth potential is due to the average speed at which vehicles drive 
when using the traffic infrastructure. This is clear from Fig. 16.7, which shows a dispro- 
portionate increase in capacity in the range of lower speeds and a flattening-out towards higher 
speeds. When capacity is reached, the speeds on highways are about 80 km/h. On urban main 
roads, the platoon starting at green, which determines capacity at signal lights, moves at an 
average of 20 km/h. Because of this difference in speeds, autonomous vehicles have a very 
different impact on the capacity of transportation infrastructure elements. 

In addition to the capacity level achievable by including autonomous vehicles, the 
stability of the traffic flow at high traffic volumes is important. In city traffic at a capacity 
utilization of 70-80 %, there is admittedly a constant traffic backlog before the relevant 
traffic signal, which is why it is no longer possible to drive through without stopping 
(green wave) at high traffic loads. Nevertheless, there will be a drop in capacity, as is the 
case in extra-urban traffic, especially on highways. To this extent, the stability of traffic 
flow is not compromised on the urban road network until it reaches full capacity—and 
only then when an overload causes blockages at the intersections. 


16.4 Conclusion and Outlook 


16.4.1 Traffic 


This analysis, with the help of the macroscopic traffic flow models, shows that, in prin- 
ciple, a significant increase in capacity can be expected from using autonomous vehicles 
and that this would also enable a more efficient use of the existing transport infrastructure. 
Along with the expected increase in capacity for existing traffic infrastructure, traffic jams 
and lost time are reduced, which in turn improve the quality of traffic flow. In particular, 
two factors are responsible for the increase in capacity: 
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(a) One factor is the shortening of headways between autonomous vehicles. In this 
context, it is significant that ride comfort is maintained, despite the short time gaps, 
by anticipating the actions of the preceding vehicles and thereby enabling lower 
acceleration or deceleration. This could also be important for column stability. The 
intercommunication of vehicles and infrastructure appears to be an important pre- 
requisite for this. 

(b) In addition to the duration of the time gap, the speed of the vehicle group is very 
important. The higher the speed at a constant density, the higher the traffic volume 
over a cross section. However, achieving high speeds while maintaining traffic 
density is possible only in purely autonomous traffic. A single human-driven vehicle 
in the column would lead to slower speeds and reduce the capacity gain. 


16.4.2 Infrastructure 


The models developed for traffic flow and capacity, assuming a given share of autono- 
mous vehicles, show that capacity increases disproportionately highly as the share of 
autonomous vehicles increases. It should be noted that the shortening of the time gaps 
comes into effect as early as the first autonomous vehicle; the speed increase at high 
densities, however, will only be possible for purely autonomous traffic. The introduction 
of autonomous vehicles will succeed, in the opinion of the author, only in their ability to 
move safely in mixed traffic, as reserved transit areas would not be socially or econom- 
ically acceptable, particularly with a low share of autonomous traffic. 

However, once a sufficient number of vehicles with autonomous capabilities are par- 
ticipating in traffic, it will be very beneficial to the transport efficiency to create reserved 
lanes for autonomous driving. The benefits of autonomous vehicles can be maximized by 
separation due to the nonlinear course of the capacity once nonautonomous vehicles are 
added to autonomous traffic. In conjunction with specially dedicated lanes, the column 
speed could also be increased even when traffic demand is higher, which would lead to 
further significant capacity gains. This is not possible in mixed traffic, since even in traffic 
with only a few human-driven vehicles, these would dictate the speed. 

In an initial analysis of this far-reaching subject, this article has solely focused on the 
traffic effects of autonomous vehicles on sections of motorways and, with an eye to urban 
traffic, at intersections with traffic lights. These two driving situations to a large extent 
determine the quality of the traffic flow. However, there are a number of other relevant 
driving situations that may have a significant influence on the capacity of the overall system: 


(a) Outside of urban areas, these are the entry, merging and exit maneuvers at the inter- 
sections of major roads. Firstly, we can look forward here to further developing 
already-emerging technical solutions with assistance functions, such as the merging 
assistant, particularly in regard to the possibilities of machine cooperation. Secondly, 
solutions for structural and regulatory adjustments to transportation facilities are still to 
be developed. For example, one interesting scenario is where autonomous traffic is 
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directed onto separate lanes between motorway intersections. This separation is then 
removed in intersection areas. In an intersection area, autonomous and 
human-controlled vehicles thus drive in all lanes and each may perform all maneuvers 
(autonomous, highly assisted or human-driven) at a perhaps predetermined low speed. 
(b) Within urban areas, there are still issues regarding the impact of the so-called conditional 
compatibility that have to be clarified. Conditional compatibility occurs when different 
traffic flows crossing at traffic signals are given the green light, requiring rules of right of 
way to be adhered to. This, for example, is the case in traffic flows turning right or left, 
which must grant right of way to pedestrians and cyclists travelling parallel to the traffic. 
Various approaches could be interesting for this purpose and should be subjected to closer 
scrutiny. Thus, one could give the green light to all lanes of autonomous vehicles 
simultaneously in a separate phase—the maneuvers of the conflicting flows in the 
intersection area would be negotiated independently by the autonomous vehicles. All 
other road users would be controlled by the existing signaling. Another possible solution 
would be to consider cyclists and pedestrians in a separate phase with “all green”, thus 
maximizing vehicle-flow compatibility by using an appropriate phase structure. 


16.4.3 Cooperation 


For scenarios such as this last, where traffic at intersections is self-organizing, autonomous 
vehicles need to be able to communicate among themselves and with the infrastructure. 
Anticipating the maneuvers of moving vehicles ahead, and the reactions in the next 
column that depend on this, results in a comfortable and thus acceptable rate of accel- 
eration, also ensuring the experience of travelling in the vehicle is pleasant. For this 
reason, currently existing technologies for communication and cooperation will play an 
important role in the development of autonomous driving. 
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17.1 Introduction 


Advancing vehicle automation promises new opportunities to better meet society’s future 
mobility demands. New, extended concepts for interaction with machines are arising in 
certain areas [1]. A prerequisite for this is further technological development of assistance 
systems with more capable sensor and information technologies, allowing for a steady 
automation of driving tasks in vehicle control, right up to self-driving vehicles [2]. 

Initially the following meta-analysis documents exemplary investigation of potential 
safety-enhancing vehicle systems with low degrees of automation. However, a safety 
prognosis of highly or fully automated vehicles depends on assumptions, as so far no 
series applications of such features exist. For testing methods in order to develop and 
validate safe automated vehicles with reasonable expenditure, the author recommends 
combining area-wide traffic, accident, weather, and vehicle operation data as well as traffic 
simulations. Based on these findings, a realistic evaluation of internationally and statis- 
tically relevant real world traffic scenarios as well as error processes and stochastic models 
can be analyzed (in combination with virtual tests in laboratories and driving simulators) 
to control critical driving situations in the future. 
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17.1.1 Motivation 


In terms of advancing automation, automobile manufacturers have been offering active 
steering-assistance systems (Lane Keeping Assistance Systems—LKAS) in combination 
with adaptive cruise control for series production vehicles since as far back as the turn of 
the millenium. The combined functionality was available on the Japanese market for 
right-hand drive vehicles such as the Nissan Cima (2001) and the Honda Inspire (2003). 
When using both assistance systems, short-term, partially automated driving (see 
Sect. 17.1.2) of up to 20 seconds was possible under the supervision of the driver (au- 
thor’s test drives in 2003). Since 2008, German manufacturers, starting with the VW 
Passat CC, have also been selling active steering systems optionally in selected models 
[3]. Opportunities for greater traffic safety increase with rising vehicle automation. Further 
market penetration of standard equipped safety-enhancing driver-assist systems will lead 
to a further reduction in road accidents (see p. 344, Sect. 17.4.1). 

According to figures from the Federal Statistical Office of Germany, 3475 people were 
killed in road accidents in Germany in 2015 [4]. On average around nine people a day lose 
their lives in this way on German roads alone. Among these accidents are some that can be 
prevented by automated vehicles in future. A potential safety benefit can be determined on 
the basis of accident data. The examples given in this article demonstrate the possibilities 
and limits of analyzing this data. What is meant here by potential safety benefits is the 
predicted fall in accident-related damage. Prerequisites in order to determine specific 
potential safety benefits are basic assumptions about the overall traffic situation and about 
the proportion of automated driven mileage with its corresponding functional limits. 

Traffic accident research is carried out worldwide by various organizations. Their 
research encompasses the subfields of accident surveys/-statistics, accident reconstruction, 
and accident analysis [5]. Accident investigation, carried out by the police in all federal 
states, forms the basis for accident research in Germany. Furthermore, other institutions 
such as the Traffic Accident Research Institute of TU Dresden GmbH (Verkehrsunfall- 
forschung, or VUFO) and the Hannover Medical School, as well as vehicle manufacturers 
and the German insurance industry, all carry out their own accident research. Central to 
this is investigating accidents directly at the scene, statistically recording and analyzing 
them according to certain characteristics, and, where needed, using this to further develop 
future vehicle automation. Regarding automated vehicles’ potential safety benefits, the 
following elaboration exemplarily demonstrates potentials, limits of findings and predic- 
tions given by accident-data collections. 

The following questions will be discussed, using specific examples from accident 
research: 


— What significance do analyzes and findings from road-accident research hold for the 
introduction of automated vehicles? 
— How can the potential safety benefits of automated vehicles be established? 
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17.1.2 Categorizing the Levels of Driving Automation 


Three categories for levels of driving automation (concerning the degree of vehicle 
guidance) are outlined briefly below, and will later be used as examples to illustrate the 
potentials and limits of accident data analysis. For use in subsequent sections here the 
categorization of the previous BASt-project group “Legal consequences of an increase in 
vehicle automation” [6] published in 2012 is sufficient. These five degrees of automation 
begin with the original conventional vehicle guidance, termed “driver only”, where the 
driver is permanently responsible for the vehicle’s longitudinal and lateral motion. The 
gradations continue with driver assistance (“assisted”) and partial automation (“partially 
automated”), with constant driver supervision at all times. Lastly, the levels of high 
automation (“highly automated”) and full automation (“fully automated”) permit humans 
to stay out of the vehicle-guidance process some or all of the time [6]. 

Another five levels were also defined by the American NHTSA agency [7]. Subse- 
quently the SAE International, formerly the Society of Automotive Engineers, developed 
further six distinctions, as described in its J 3016 informational report. They are being 
increasingly used in today’s research projects. These levels correspond precisely to the 
BASt levels published previously in 2012, with two key differences. First, the names are 
different. Second, SAE adds level 5 (full automation), at which the automated driving 
system performs the entire dynamic driving task under all conditions that can be managed 
by a human driver [8] (see below Fig. 17.1). 


17.2 Accident Data Collections to Demonstrate Potential 
Safety Benefits 


According to accident statistics, a fatal road accident occurs on average: 


— every 2.7 hin Germany 
— every 25 min (ca. 34,000 annually) in the USA 
— every 26 s (at least 1,240,000 annually) worldwide [4, 9, 10]. 


Since the early 1970s, measures taken in road building, legislation, the rescue chain, 
emergency medicine, and passive and active vehicle safety have lowered the numbers of 


Level 5 - full automation 


Fully automated Level 4 = full self-driving automation 5 = Level 4 - high automation 
Highly automated Level 3 — limited self-driving automation a = Level 3 — conditional automation 
Partial automated Level 2 — combined function automation g E Level 2 — partial automation 
Assisted Level 1 — function specific automation ô Q Level 1 — driver assistance 
Driver only Level 0 — no automation 3 Level 0 - no automation 


> BASt > NHTSA > SAE (J 3016) 


Fig. 17.1 Levels of automation according to BASt, NHTSA and SAE. Image rights: Author 
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injuries and fatalities in road accidents considerably in Western countries. This finding is 
based on large-scale worldwide collected surveys and analyzes of road accidents with 
various orientations, amount of data and from surveys of varying depth. Selected 
accident-data collections that exemplify on automated vehicles’ potential safety benefits 
will now be introduced, along with their respective pros and cons. 


17.2.1 Federal Road-Traffic Accident Statistics in Germany 


In accordance with Section 1 of the StVUnfStatG (§1, German law on statistics of road 
traffic accidents) from 1990, the Federal Statistical Office of Germany in Wiesbaden 
publishes monthly federal statistics on fatalities, injuries, and property damage. All police 
stations are obliged to submit defined records of reported accidents, and to pass on 
information from traffic accident reports to state-level statistics offices [4]. 

The nationwide statistical data is published regularly on the Internet. The cause of 
accident determined by police investigation, which essentially evaluates drivers’ driving 
errors, shows the potential for automated driving (see p. 344, Sect. 17.4.1.1; p. 351, 
Sect. 17.4.3.2). All documented information is subdivided into clear categories, e.g. type 
of road, age of all parties including the people causing the accident, and type of transport 
means. There is no specific documentation on accident reconstruction, injuries or vehicle 
details available. 


17.2.2 German In-depth Accident Study (GIDAS) 


Extensive data is required for the detailed and statistically reliable analysis of 
road-accident scenarios. In Germany, the database of GIDAS (German In-Depth Accident 
Study) is qualified for many of these purposes. Nationally and internationally recognized, 
it is considered one of the most comprehensive and significant accident databases in the 
world [5, 11]. In-depth analysis at the accident location follows an incidence of personal 
injury involving any type of vehicle, and has been supported in Germany by the Federal 
Highway Research Institute (BASt) since 1973 and the Research Association of Auto- 
motive Technology (FAT) since 1999. Today, the GIDAS project anonymizes and places 
in a separate database some 2000 accidents annually, with up to 3000 coded parameters, 
from the survey areas of Hannover (since 1973) and Dresden (since 1999). Each docu- 
mented accident contains information on the environment (e.g. weather, road type, road 
condition, environment), the situation (e.g. traffic situation, conflict situation, and type and 
manner of accident), the vehicles (type, safety equipment), and personal and injury data 
including a sketch of the accident with reconstruction and image data [5, 11, 12]. 

The benefits of the GIDAS data are based on in-depth analyses with several types of 
vehicles causing injury to persons, the related accident site, and the field of medicine. To 
aid further analysis, many cases are reconstructed and simulated electronically to a high 
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level of detail with the PC-Crash simulation software from the Austrian company 
DSD-Datentechnik www.dsd.at [13]. One disadvantage lies in the fact that data access is 
limited to car manufacturers and component suppliers taking part in the project. The 
investigation criteria only include accidents involving injuries. Although only the Han- 
nover and Dresden areas are surveyed, the results are transferable to the whole of Ger- 
many via extrapolation (in technical terms: weighting and comparison with official 
accident statistics, see Sect. 17.2.1). 


17.2.3 Road-Traffic Accident Statistics in the USA 


In the USA, the National Highway Traffic Safety Administration (NHTSA) has been 
consistently documenting every fatal road accident since 1975 using the Fatality Analysis 
Reporting System (FARS) [9]. Furthermore, the National Automotive Sample System— 
Crashworthiness Data System (Nass-CDS) has existed in the USA since 1979 [14]. The 
program analyzes road accidents involving personal injury or severe property damage 
using interdisciplinary teams, similarly to the German GIDAS project. 

In-depth data collections for extended accident analysis can also be found in the USA, 
although, unlike GIDAS, they offer no reliable accident reconstruction. For example, it is 
not possible to assess emergency braking functions [11]. Accident risks in the USA differ, 
e.g. due to the longer distances driven. The drop in US traffic accident fatalities since 1970 
is lower, at around 16 %, than in Germany, at around 60 % [4, 9]. 


17.2.4 Road-Accident Data in Asia, Taking the Examples of China 
and India 


Traffic accident data collection in Asia is still in its initial stages. Analysis is superficial 
and permits no reliable reconstruction. While initial approaches to reliable data collection 
have been made in China, the number of traffic accident fatalities is not even recorded in 
India [11]. 


17.2.5 International Road-Accident Data Collections 


The International Road Traffic and Accident Database (IRTAD) consists of a collection of 
various national official accident statistics. It includes road accidents involving personal 
injury generally as well as fatalities—distinguished by age, location and type of road 
use—and is maintained by the Organisation for Economic Co-operation and Development 
(OECD) in Paris. Besides the countries bordering Germany, it contains data from: Aus- 
tralia, Canada, Finland, Greece, Hungary, Iceland, Ireland, Israel, Italy, Japan, Luxem- 
bourg, New Zealand, Norway, Portugal, Slovenia, South Korea, Spain, Sweden, the UK 
and the USA [10]. 
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The data is publicly accessible on the Internet and especially suited to comparing the 
data between countries included. It is possible to study the impact of various regulations 
and collective driving behavior (north vs. south, for instance). In-depth information on the 
details as to how the accident occurred is still lacking, however. Moreover, survey 
methods and data volumes vary from country to country. 

Another initiating action for harmonisation of global in-depth traffic accident data is the 
Initiative for the Global Harmonisation of Accident Data (IGLAD). IGLAD was initiated 
in 2010 by European car manufacturers to improve road and vehicle safety. The database 
contains accident data according to a standardised data scheme. This should enable 
comparison between datasets from different countries. The first phase of the project was 
funded by the European Automobile Manufacturer’s Association (ACEA). The growing 
data set of the second phase, which started 2014, contains 93 variables regarding the 
accidents, roads, participants, occupants and safety systems. Limited data (between 50 and 
200 cases, data years 2007-2012) from each of 11 countries (Australia, Austria, China, 
Czech Republic, France, Germany, India, Italy, Spain, Sweden and USA) are available for 
research. 


17.2.6 Accident-Data Collections of Auto Manufacturers 


In order to collect findings on accidents involving current vehicles, and to fulfill product 
monitoring obligations, interdisciplinary expert teams from car manufacturers and com- 
ponent suppliers today carry out accident analysis at the scene together with hospitals and 
the police. The results primarily serve continuing improvements in the effectiveness of 
vehicle safety systems currently in use. 

Moreover, the analysis of accident incidents by the manufacturer serves in complying 
with mandatory duty of care and observing potential product dangers that may arise 
during use. According to Section 823 of the German code of civil law (BGB), an auto 
manufacturer is liable for errors of its products’ consequential damages arising from 
intended or foreseeable use by the driver or other persons. A car manufacturer must 
therefore collect and analyze information on vehicle use and innovative systems. The 
more dangerous a product is, the greater the obligation to protect and monitor a product’s 
safety in and after the development process [15], (see Chaps. 21, 23 and 28). 

Among the car manufacturers Mercedes-Benz (now: Daimler AG) began investigating 
road accidents involving its Mercedes vehicles together with the police of the district of 
Böblingen as far back as the late 1960s. Two years later, Mercedes’ accident research had, 
with ministerial permission, access to regular telephonic information and insight into the 
accident files of the police in Baden-Württemberg. Since at least the 1970s, other man- 
ufacturers such as BMW have been studying and recording collisions involving their own 
vehicles on a larger scale. Volkswagen began cooperating with the insurers association 
Haftpflicht-, Unfall-, Kraftversicherer-Verband (HUK-Verband) in the late 1960s and with 
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the Hannover Medical School MHH (the predecessor of GIDAS) starting from 1985. 
Volkswagen has been recording its own data since 1995 [11]. 

In-depth, interdisciplinary analysis of accidents by car manufacturers involving new 
types of vehicles with the latest safety technology and especially involving function 
developers enable clear insights into the potential benefits of driver-assistance systems. 
However, around a few hundred cases per year exclusively involving a brand’s own 
vehicles are not comparable with GIDAS data in terms of their statistical validity. 


17.2.7 Accident Data of the German Insurance Association 


The German Insurance Association (Gesamtverband der Deutschen Ver- 
sicherungswirtschaft—GDV), the successor organization of the HUK-Verband, has at its 
disposal documented information on incidences of damage from motor claims of German 
insurers where compensations for damages based on contracts were paid. These data 
benefit the GDV for example in grading insurance contracts, or in determining the 
potential safety benefits of driver-assistance systems [16]. 

Accident research by insurers has access to all cases of motor-vehicle liability losses 
reported with the GDV. Unfortunately, the data are not open to the public. Accident 
analysis does not take place at the scene and the accident-recording criteria are not 
comprehensive. Moreover, the insurer’s interest in the particularities of a case ends as 
soon as it sees liability to pay. This therefore means that there is only little detailed 
information on the cause of undisputed cases. In single-vehicle accidents with only one 
party involved, such as so-called driving accidents, when a driver loses control of the 
vehicle, there is mostly no data available on the cause [11]. 


17.2.8 Accident-Data Collections of Consumer Associations (ADAC) 


ADAC (the German automobile club) has been carrying out accident research since 2005. 
It is a cooperation project between ADAC air rescue and the ADAC technology center. 
From rescue flights, information on around 2500 severe accidents nationally is collected in 
the ADAC database annually. The accident data is sourced from the police, doctors, fire 
service, and motor-vehicle assessors [17]. 

The ADAC accident data contains information on road accidents with seriously injured 
persons. They include aerial pictures with a vehicle’s final position and a detailed medical 
diagnosis. Supplementary individual assessment is possible using the files, although the 
data is not publicly accessible. There is no concluding interdisciplinary reflection with the 
respective persons investigating the accident. 
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17.3 The Fundamentals of Accident-Data Analysis 
17.3.1 Level of Data Collection Versus Number of Cases 


The validity of accident data regarding potential safety benefits varies considerably 
depending on the collection method. In-depth surveys are mostly carried out in cooper- 
ation with qualified interdisciplinary teams. Particularly well-founded results are achiev- 
able when function developers, accident analysis experts, doctors, and traffic 
psychologists work together on analyzing individual cases. But this level of data col- 
lection is usually restricted to a low number of cases, hampering its statistical validity. 

Evaluations from accident databases indicate which measures are needed to increase 
traffic safety. A detailed accident analysis including an accident reconstruction encom- 
passes a retrograde calculation of speeds from traces of the accident, an investigation into 
how the accident arose, a check for accident fraud, consideration of how avoidable it was, 
and biomechanics. An evaluation of future systems’ potential benefits based on this 
requires extensive knowledge of the given conditions and framework. 

Until now, forward-thinking ideas on improving vehicle safety have primarily come 
from combining accident analysis, existing experience and extensive research work. 
Accident research is one way to determine the efficiency of existing automated vehicle 
functions and the need for new safety-enhancing ones. In what follows, basic terms of 
accident-data evaluation are explained. 


17.3.2 The Validity of Areas of Action Compared to Areas 
of Efficiency 


When comparing various accident-data analyses, both the way in which data is collected 
and the way it is processed must be distinguished. Frequently, areas of action adopted 
under optimal conditions are confused with areas of efficiency under real conditions. 
An area of action covers the accidents that a system can influence. The area of action 
can vary depending on how precise a system’s specification is defined. As a result it is an 
initial estimation for the maximum achievable potential of the regarded level of 
automation. The actual resulting efficiency of a function, on the other hand, is usually 
significantly lower. Efficiency here is the effect that a specified system actually has. It is 
either proved in the occurrence of accidents (a posteriori) or predicted by a simulation (a 
priori). 
Determining an area of efficiency thus demands precise knowledge of two factors: 
— the system specification with its corresponding function limits 
— the driver’s behavior. 


The degree of efficiency describes a function’s relative efficiency as a percentage and is 
always dependent on the unspecified term of the area of action [18]: 
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area of efficiency 


= x [%] (17.1) 


degree of efficiency = 7 
5 y area of action 


17.3.3 Potential Safety Benefits Depending on the Level 
of Automation and Degree of Efficiency 


Some analyses of potential safety impacts using accident databases examine the maximum 
assumed area of action described above. In contrast, analyzing the degree of efficiency 
comes closer to reality by assessing an area of efficiency for its actual benefit [18]. The 
resulting safety benefits of automated vehicles only arise, though, after all risks have been 
taken into consideration. The benefit complies with the reduction of accident frequency 
and severity. New risks exist in terms of as-yet nonexistent accidents that may arise with 
increasing automation. 

The theory of inventive problem solving (TRIZ) defines the requirements of an ideal 
machine by the formula of an ideal final result with an unlimited benefit without costs and 
damages [19]: 

X benefit oo 


ideal final lt = — = 17.2 
en (X` costs + ` damages) (0+0) = ne) 


On the one hand, when looking at the actual total consumer-relevant potential as 
regards the safety benefit of automated vehicles, this increases in accordance with the 
degree of efficiency up to the maximum area of efficiency (proof by accident data analysis 
and knowledge of functions). On the other hand, the risks may increase in line with the 
level of automation (“Driver” vs. “Robot”). These in turn reduce the actual safety benefit 
(see Fig. 17.2). To minimize potential risks, manufacturers carry out risk management 
(see Chap. 28) that takes accident data into account. 
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Fig. 17.2 Consumers evaluate the potential safety benefits subjectively by weighting up the 
perceived risks and benefits in the relevant contexts. Risks depend on the level of automation, 
benefits on the degree of efficiency. Accident-data analysis and risk management (see Chap. 28) 
allow for objectivation (see Chap. 30) and optimization. Image rights: Author 
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17.4 Significance of Possible Predictions Based 
on Accident Data 


Using examples, the following meta-analysis shows what is and is not possible when 
drawing conclusions about potential benefits on the basis of various accident data. As 
there is no existing experience of analyzing highly and fully automated vehicles, systems 
without automation (“driver only”/“no automation”) or with low levels of automation 
referring to the main driving task (“assisted”/“partially automated”) are considered first, 
divided into a-posteriori- and a-priori-analyzes. 

Section 17.4.1 describes examples of a-posteriori-statements on accident data collected 
so far. In the definition used here, figures “gained from experience” [20] can be used 
directly for interpretations. In contrast, the a-priori-forecasts defined in Sect. 17.4.2 are 
based on accident-data collections to assess the potential benefits of future levels of 
automation, exclusively using assumptions “obtained by logical reasoning” [20]. 


17.4.1 A-Posteriori-Analyzes of Accident Data for “Driver Only”/ 
“No Automation” 


Past and present a-posteriori-analyzes of accident-data collections with conventionally 
(human-) driven vehicles form the basis for direct insights into accident black spots and 
changes in real-life traffic accidents. In this “driver-only”/ “no-automation” category, there 
are neither warnings nor interventions in longitudinal and lateral guidance on the basis of 
environmental sensors. 

To illustrate this, the change in the numbers of accident deaths serves as one example 
(see Sect. 17.4.1.1), the impact of Electric Stability Control, or ESC, is another (see 
Sect. 17.4.1.2). 


17.4.1.1 Traffic Statistics: Accident Fatalities Versus Registered 

Motor Vehicles 
One example of what currently available accident data can show is the relationship of 
traffic accident deaths to vehicles registered, taken from data of the German Federal 
Statistics Office. This demonstrates that numbers have been dropping in Germany since 
the dramatic figure of 21,332 traffic accident fatalities in 1970 [4]. 

In short, the accident data shows that the number of traffic fatalities dropped from over 
21,000 in 1970 to almost 3000 per year—at the same time as increases in registered 
vehicles occurred. The multifarious causes of this lie in the area of various legislative, 
technological, medical, and infrastructural measures (see Fig. 17.3). The overlapping of 
all safety measures makes it difficult to prove the effectiveness of any single potential 
safety benefit. 


17 Safety Benefits of Automated Vehicles ... 345 


ame Standardized emergency call 112 (1973/Euro-Call 2009) 25,000 
Mandatory seat belt use (1976) 
50,000,000 Fine for not wearing tbelð (84) 20,000 
Mandatory child seat (1993) i 
0.5% Alcohol limit (2001) 
0 Cellphone ban (2001) 15,000 
— Number of registered vehicles 
=0,000,900 = Traffic fatalities 
10,000 


Front airbag (1980) 


Sa Side airbag (1995) 
` Head airbag (1997) 


0 Assisted — Partial automated EBA (96) ACC, AEB, LDW, LCA, NV... 
1970 1973 1976 1979 1982 1985 1988 1991 1994 1997 2000 2003 2006 2009 2012 2015 2018 .. 2070 


20,000,000 


5,000 


Fig. 17.3 Reduction of traffic fatalities due to safety enhancements despite increase of registered 
motor vehicles in Germany. Image rights: Author 


17.4.1.2 Studies on the Effect of “Driver-Only”/“No-Automation” 
Systems 

Electronic Stability Control, or ESC, introduced in 1995, is technically built up on 
anti-lock braking, or ABS, introduced in 1978. It uses that system’s wheel speed sensors 
together with additional sensors for yaw rate, steering wheel angle, and lateral accelera- 
tion. Using the information from these sensors, ESC tries to stabilize the vehicle in case of 
a recognized skid by independently braking individual wheels. With this braking inter- 
vention, ESC can convert a lateral collision into a less vulnerable frontal crash. In 2001, 
Daimler accident research assumed that 21 % of skid accidents resulted in injuries and 
43 % in fatalities [21]. The findings of accident-research experts investigating individual 
cases on behalf of vehicle manufacturers diverged greatly at that time. Later predictions of 
potential benefits based on larger amounts of data also differ. Areas of action from the year 
2000, for instance, show a positive impact of up to 67 % for severe accidents due to 
skidding [22]. Other studies found that ESC provides the second-most effective increase in 
safety in the “driver-only” category, after the introduction of safety belts as a passive 
safety system [2]. The proportion of accidents caused by driver-error and skidding, for 
example, fell after the introduction of ESC as a standard in all Mercedes-Benz cars from 
about 2.8 involved cars (per 1000 registered in Germany) in 1998/1999 to 2.21 involved 
in 2000/2001. ESC’s high effectiveness could also be verified in other car brands such as 
Volkswagen, where accident statistics show lower accident frequency and prevention of 
especially critical accident types [22]. 

In summary, safety benefits can already be proven today for safety-enhancing 
“driver-only” functions with quick market penetration depending on various data sources 
and suppositions. Particularly for ESC, safety impacts can be well-founded scientifically 
verified. 
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17.4.2 A-Priori-Forecasts for Assisted and Partially 
Automated Driving 


A-priori-forecasts are tied to hypotheses and inferences. Assisted and partially automated 
driving functions, for example, can save the driver from imminent danger via optic, 
acoustic or haptic warnings or short braking or steering interventions with a warning 
character. A prerequisite for successfully averting danger, however, is the assumption that 
the driver will react in time and appropriately to the traffic situation. 

From a technical point of view, these advanced levels of automation—with extended 
computer and sensor technology for environmental perception—allow for increasingly 
capable assistance systems. Some safety-enhancing driver assistance systems on the 
market today give warnings when there is recognized danger in parallel and crossing 
traffic. These include collision warning systems as EBA—Electronic Brake Assist, ACC 
with FCWS—-Adaptive Cruise Control with Forward Collision Warning System, LCA— 
Lane Keep Assist, LDW—Lane Departure Warning, NV—Night Vision or intersection 
assistance. Other systems intervene in the longitudinal and lateral vehicle dynamics, such 
as Electronic Brake Assist (EBA) or Autonomous Emergency Brake (AEB), (see 
Fig. 17.3). 


17.4.2.1 Study on the Potential of Lane Departure Warning 

One approach to analyzing road accidents together with doctors, psychologists and 
development engineers was introduced in 2006, using the example of a Lane Departure 
Warning (LDW) system [24]. The results, achieved with the participation of the author of 
this paper, a psychologist, and a function developer, were based on an interdisciplinary 
research community between a car manufacturer, a university hospital, and the police, 
with support from the Bavarian Ministry of the Interior, Building and Transport (BStMI). 

Such interdisciplinary analyzes of accident causes and consequences include exam- 
ining the technical, medical, and psychological details by experts from each field, then 
integrating all results collectively. Today, for instance, driving-related psychological data 
is increasingly collected to analyze a road accident. Using standardized interviews, the 
experience of a collision is recorded and evaluated from the driver’s point of view. 
Technical reconstruction of the accident is supplemented by a traffic-related psychological 
perspective. 

In coordination between the professional teams, taking the example of Lane Departure 
Warning, it was explained what specifications of the system design had to be met. Specific 
focused questions from the technological development allow the selected accidents to be 
filtered further. This gives insight into the accident-avoidance potential of the systems 
under development. For this purpose, knowledge of the system’s specific technical limits 
is crucial. Recommendations for further functional system enhancements are also possible 
[24]. 

In conclusion, these detailed accident analyzes show the benefit of comprehensive 
accident-data collection. Within this study, experts on technology, medicine, and 
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psychology were closely interconnected. The interdisciplinary approach delivers numer- 
ous additional references in terms of vehicle details, accident scenes, parties involved in 
accident, injury patterns and witness statements. This extra information provides insight 
into active steering corrections, interventions of the brakes and reactions immediately 
preceding a collision, as human errors such as fatigue, inattentiveness or distraction are the 
main causes of lane departure. Various directions from which an interdisciplinary team 
analyzes the accident allow the computer-aided reconstruction and simulation of an 
incident to be highly realistic. To determine representative findings from this, however, it 
is necessary to validate it with larger accident-data collections. 


17.4.2.2 Interdisciplinary Degree of Efficiency Analysis Based 
on Current Driver Assistance Systems 

Building on the advantages of interdisciplinary analysis of the effectiveness of Lane 
Departure Warning, a further interdisciplinary degree-of-efficiency analysis was carried 
out four years later. The objective was to compare available safety-enhancing 
driver-assistance systems which were available on the market. This study used a sam- 
ple of reconstructed accidents (n = 100) in close consultation with the respective function 
developers. Therefore an interdisciplinary accident-data evaluation was carried out by the 
author together with a psychologist. Regarding accident causes, the driver assistance 
systems’ effectiveness at avoiding accidents depending on the situation was analyzed [25]. 
The range of systems available for study in early 2010 included Night Vision, Lane 
Departure Warning, Lane Change Assistant and Adaptive Cruise Control. To establish the 
degree of efficiency, accident research data, weighted according to accident statistics for 
Bavaria, was analyzed. In the process, real-life accidents were compared with the 
reconstructed accident scene, and the accident cause was assessed in terms of 
human-machine interaction. This was done in line with the human-machine interactions 
described in the ADAS Code of Practice for the development of Advanced Driver 
Assistance Systems (ADAS) with active longitudinal- and lateral guidance [26]. After 
many years of preparation [27, 28] it was published by the European Automobile Man- 
ufacturer’s Association (Association des Constructeurs Européens d’Automobiles— 
ACEA) in 2009 [29]. The potential for preventing accidents was only deemed to be 
positive if every development expert for the relevant system agreed. The results showed 
that the examined systems could significantly contribute to reducing the severity of 
accidents. 

Overall, the study predicts that the investigated driver assistance systems would pos- 
itively impact accident prevention, with a 27 % drop in the total number of injured 
persons. The number of injured would thus be reduced from 126 drivers and 49 pas- 
sengers to 94 and 33 respectively. It should be kept in mind that the results assume 
optimal reactions in terms of human-machine-interactions. This would need to be verified 
by studies with test persons before drawing final conclusions. Further, 100 % distribution 
of the systems, operating error-free within the system limits, would have to be assured. 
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The injury grading adopted was based on the Abbreviated Injury Scale (AIS) [30], as 
also used in ISO 26262 for functional safety [31]. The AIS codes every injury to the 
human body with a numerical value between | (light injuries) and 6 (extremely critical or 
fatal injuries). The most severe injury of all individual injuries of one person is thus 
defined as MAIS (Maximum AIS). An uninjured person is classified with MAIS 0. 

Analyzing accident causes further revealed that more than 60 % of them involved 
so-called information errors—malfunctions of information access and information 
reception. This explains the correspondingly high effectiveness of warning assistance 
systems [25]. 

In summary, currently available driver assistance systems were compared in an 
interdisciplinary study, with the respective developers taking part in the analysis. Each 
individual developer knows the specific relevant function parameters of his system, thus 
allowing for more accurate assessments of potential benefits. It has to be noted that the 
sample of 100 cases in the area-of-action study, weighted in comparison with represen- 
tative accident data from Bavaria, is too small to provide statistically reliable statements 
based on the results obtained. However, it is possible to derive a tendency where these 
driver assistance systems contribute substantially to road safety. 

Attention should be drawn to the fact that there are further options for obtaining 
statistical evidence to the forecast safety gains of braking assistance and automatic 
emergency braking functions. In addition, there are assessment methods for forecasting 
safety benefits based on simulations using software-based accident reconstructions [32]. 


17.4.2.3 GIDAS Database Analysis for Potential Safety Benefits 
of Connected Vehicles 

Based on a larger data volume, the following analysis of the German In-Depth Accident 
Study (GIDAS) database shows the complexity and variety of several assumptions. 
Together with a team of experts, the author carried out this analysis with a more signif- 
icant sample in 2009 as part of the Safe and Intelligent Mobility— Test Field Germany 
(Sichere Intelligente Mobilität: Testfeld Deutschland—simTD) research project. The 
objective of the analysis was to assess the potential benefit of future safety-relevant 
vehicle communications systems. Functions for connected systems with a direct safety 
impact on road traffic were considered. The underlying data encompassed 13,821 acci- 
dents involving personal injury documented by GIDAS from 2001 to 2008 in the areas of 
Dresden, Hannover, and their surroundings [12]. To extrapolate this for the whole of 
Germany, the data acquired in the statistical sampling scheme was weighted using acci- 
dent statistics from the German Federal Statistical Office. These official statistics contain 
all accidents involving personal injury registered in Germany over the calendar year. In 
2007, for instance, there were 335,845 road accidents involving personal injury [4]. 

The variables needed for the analysis were precisely defined in several consultations 
with the simTD function developers and accident experts from Audi, BMW, Bosch, 
Daimler and Volkswagen. All project participants agreed to begin by analyzing 13 
safety-related warning functions. The participants jointly decided to look at relevant 
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vehicles such as cars, trucks, buses, agricultural tractors, rail vehicles (including trams and 
city railways, but no Deutsche Bahn trains) and motorbikes (motorized two-wheelers, 
three-wheelers, quad bikes from 125 cc) in the course of several workshops. This was 
followed by very intensive work to determine the areas of action using the extensive 
GIDAS data. This selection was initially made by taking the variables from all accidents 
relevant to each system relating to the complete accident occurrence. It showed that the 
areas of action for each individually examined function varied in a wide range between 0.2 
and 24.9 %. Areas of action can thus only give an estimation of the maximum effec- 
tiveness that cannot be exceeded with great certainty. It should also be noted that it is not 
possible to add up individual areas of action, due to their overlapping between functions. 

In a subsequent degree of efficiency analysis, three assumed function types (electronic 
brake light, cross-traffic assist, traffic-sign assist for stop signs) from the GIDAS area of 
action analysis described above were selected. The corresponding degrees of efficiency 
were adopted by using a reduced sample of driving simulator investigations. 

For accidents avoided by the driver with cross-traffic assist (see [33]), for example, 
there was a sizeable range, from 9.9 to 73.3 %. This results from both varying driver 
reaction times and different braking intensity upon warnings. Therefore, three reaction 
times (0.54, 0.72 and 1.06 s) and the respective probabilities of their occurrence were 
determined. Furthermore, in the cases of unsuccessful reactions, weak braking of 50 % of 
maximum braking pressure was assumed and 100 % for successful reactions [12]. 

In summary, this sophisticated approach to analyzing degrees of efficiency was aimed 
at determining and evaluating with statistical relevance the potential of future, connected, 
safety-enhancing driver-assist functions. The range between 10 % and 70 % that was 
found, however, diminishes the validity and thus only permits tendencies and outlooks 
concerning accidents avoided. This wide scattering is rooted in the sensitivity of the 
parameters descried above and the warning algorithm in question, as drivers’ reaction 
times and braking intensities differ greatly in practice. 


17.4.3 Potential Safety Benefits and Test Scenarios 
for Development of Highly and Fully Automated Driving 


17.4.3.1 GIDAS Databased Expert Estimates until 2070 

From a technical point of view, automated vehicles today can already autonomously take 
over many driving tasks in moving traffic under favorable conditions. While driver 
assistance systems support the driver, the advanced systems like highly and fully auto- 
mated driving temporarily or permanently take over the driving tasks. 

Among others highly and, particularly, fully automated driving is designed to approach 
“Vision Zero”. The aim is to travel as accident-free and effectively as possible. Roads and 
means of transportation should be designed in such a way that no person is killed or 
severely injured. The vision of being accident-free has its origins in occupational safety 
and was first applied to road traffic in Sweden in the 1990s. The EU has supported projects 
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for automated vehicles such as the “Highly Automated VEhicles for intelligent transport” 
(HAVEIt) research project, which was sponsored by the EU with 17 million Euros. Car 
manufacturers such as BMW, Daimler and Volkswagen/Audi are also working on visions 
of accident-free driving. Prof. Dr. Thomas Weber, member of the Board of Management 
of Daimler AG for research and development, explains in an interview: 


Unser Weg zum unfallfreien Fahren treibt uns an, die Mobilität auch in Zukunft für alle 
Verkehrsteilnehmer so sicher wie möglich zu gestalten. [21] 

(Our ‘path to accident-free driving’ also drives us to design mobility as safely as possible 
for all road users in the future.) 


The number of road accidents involving personal injury with a car as the main cause 
fell in Germany in the first decade of this century, from 266,885 in 2001 to 198,175 in 
2010. According to the Federal Statistical Office (2010), cars are the main cause of road 
accidents, at 68.7 %. The accident types mainly break down into the following categories: 
Turning at/Crossing intersections (58,725), Parallel traffic (44,812), Turning (33,649) and 
30,737 Dynamic accidents [4] (see Fig. 17.4). 

Until now, there has been no empirical proof of the overall safety gains of fully 
automated driving functions. One of the first comprehensive forecasting models in 
vehicle-safety and accident research was published by Daimler. It investigated automated 
vehicles’ potential for accident prevention by means of assumed deployment and market 
penetration scenarios. These were based on expert estimates, third-party forecasts and 
GIDAS data. The forecast, which is able to provide an initial rough estimate, is based on a 
total of 198,175 preventable collisions caused by cars in 2010 (see Fig. 17.4). The 
assumptions involve changes within each accident type (Parallel traffic, Stationary traffic, 
Pedestrians, Turning at/Crossing intersections, Turning, Dynamic accidents). It can be 
seen, for example, that accidents involving a car losing control or in parallel traffic will fall 
by around 15 % by 2060 with increasing automation, while accidents when turning at or 
crossing intersections will proportionately increase by around 10 % [34]. 
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Fig. 17.4 Passenger cars as main cause of road accidents and distribution of accident types. Source 
Federal statistical office—DESTATIS, GIDAS. Image rights: Author 
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According to these estimates for increased automation, an overall reduction of 10 % of 
accidents would be achievable by 2020. In years thereafter, reductions would be 
achievable of 19 % by 2030, 23 % by 2040, 50 % by 2050, 71 % by 2060 and almost 
total prevention by 2070 [34]. The forecast thus indicates that a car in 2070 will cause 
almost no accidents, but will be able to sustain serious collisions. It can certainly be 
assumed that an automated vehicle will be able to avoid some collisions that a third party 
would have caused. It has to be kept in mind, however, that this study does not consider 
accidents caused by other road users. Potential technical failures (see Fig. 17.6) are also 
not included. In addition, the data used from the German Federal Statistical Office, and 
above all the validity of GIDAS, mainly centers around crash and post-crash statements 
with injured people (see [35]). 


17.4.3.2 Global Accident Data Evaluation for Relevant Traffic Test 
Scenarions 

For a complete overall evaluation of highly- and fully automated vehicles’ active safety, 
the author would also recommend incorporating findings concerning worldwide accident 
data collections as well as analysis with no harm to people, near collisions, traffic sim- 
ulations and weather data. Therefore a first-time comprehensive area-wide study based on 
all police reports was carried out (see Fig. 17.7). The findings can be completed with 
information from hospitals, insurance companies and models of human behaviour. 
Knowing all relevant factors that may lead to a collision, virtual simulations can be 
performed based on detailed and quantitative models. Possible system responses can be 
classified in true positive (or negative) and false positive (or negative). The evaluation of 
automated safety functions has to consider all possible system responses [36]. 

The purpose is to comprehensively link up all international known collisions using 
geographically defined road-accident data and the accompanying high-definition geo- 
graphic digital mapping data (e.g. Google Maps, Nokia HERE, TomTom, Open- 
StreetMap) with traffic data from different sources (e.g. cars, mobile phones, road traffic 
devices). Localized accident data in the states of the USA, for example, exist via www. 
saferoadmaps.org. Similarly, the British government publishes details on www.data.gov. 
uk; these are in turn located on the UK Road Accident Map. Regional accident data in 
Germany (updated monthly) can be gathered from police software-supported IT appli- 
cations—in some federal states from the Geographic Positioning, Analysis, Representa- 
tion and Information System (Geografisches Lage-, Analyse-, Darstellungs und 
Informationssystem—GLADIS), the Road-Accident Location Map and Analysis Network 
(Verkehrs-Unfall-Lage-Karten und Analyse-Netzwerk—VULKAN), the Brandenburg 
Expert System for the Analysis and Documentation of Accident-Heavy Route Sections 
(Brandenburgisches Expertensystem für die Analyse und Dokumentation von unfal- 
lauffälligen Streckenabschnitten—BASTa), the Geographic Police Information System for 
Road accidents (Geografisches Polizeiliches Informationssystem für Verkehrsunfalle— 
GEOPOLIS V) or the widely distributed Topographical Electronic Accident-Type Map 
(Elektronische Unfalltypensteckkarte—EUSka) [37]. 
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In summary, neither reliable specifications for OEM (Original Equipment Manufac- 
turers) mass production solutions ready for market nor concrete information on the 
functional limits of highly and fully automated driving are currently available. To date, 
therefore, numerous assumptions have had to be made in forecasting potential safety 
benefits. Reliable data is also lacking on market launch and penetration. Thus today’s 
projections of potential safety benefits, based on accident data, only have limited validity. 
It is hence recommended to combine in-depth accident data collections (e.g. GIDAS) with 
all worldwide available accident data collections and analyzes, traffic simulations, related 
weather information and vehicle operation data (see Fig. 17.5). 

The learning curve in Fig. 17.6 shows the increase of available real world data before 
and after market launch of automated vehicle functions. To identify relevant critical 
scenarios the author recommends monitoring and analyzing all available data of auto- 
mated functions regularly. These provide knowledge for sensor simulation, classifications 
and decision strategies of future automated vehicles. 
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Fig. 17.5 Recommended procedure with worldwide relevant test scenarios from around the world 
based on comprehensively linked-up geographically defined accident, traffic, weather- and vehicle 
operation data collections pertaining to human and machine perception (see Fig. 17.8). Image rights: 
Author 
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Fig. 17.6 Learning curve increase of available real world data before and after market launch of 
automated vehicle functions to identify relevant critical scenarios for sensor simulation, 
classifications and decision strategies (see Fig. 17.8). Image rights: Author 


17.5 Potential Safety Benefits / Risks and Impacts on Testing 
17.5.1 Human Error and Technical Failure in Full Automation 


Presuming that most accidents are caused by human error (see Sect. 17.5.2.2) it would 
then be almost possible to realize “Vision Zero”, given fault-free fully automated vehicles. 
However, technical failure and technical limits are still to be expected—especially in fully 
automated self-driving vehicles. 

The left side of Fig. 17.7 shows the statistical cause-of-accident distribution, based on 
the GIDAS accident database. This accident data show that “human error”, at 93.5 %, is 
the main risk of road accidents. The impact of factors involving driving conditions or the 
environment—road surface quality or weather, for instance—is relatively low according 
to the statistics, at 4.6 %, as is technical failure at 0.7 % [38]. 

During fully automated driving sections, the number of accidents caused by driver 
error is ruled out completely. The “technical failure” category could become propor- 
tionally larger, with the new technical risks of fully automated driving. This will lead to 
the public giving it greater attention (see Fig. 17.7). 
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Fig. 17.7 Today 93.5 % of accidents results from human error. With full automation, there would 
be no more human error. However, the proportion of technical faults may be perceived considerably 
enlarged in future. Source GIDAS. Image rights: Author 


Further assessment and overcoming of human failure-processes in real traffic situations— 
in addition to worldwide relevant test scenarios based on comprehensively linked up geo- 
graphically defined accident, traffic, weather, and vehicle operation data collections (see 
Sect. 17.4.3, Figs. 17.5 and 17.6)—will support virtually traffic simulations for safe 
development, tests and validation of automated vehicles in the future [39]. 


17.5.2 Potential Safety Benefits-Human and Machine Performance 


Vehicles’ road safety today essentially depends on the performance of humans supported 
by safety-enhancing systems. Fully automated vehicles will only rely on the capabilities of 
machines. Depending on the degree of automation, technical systems will replace humans’ 
perceptions, experience, judgment and capacity to react. Both the potential safety benefits 
and risks of increasingly automated vehicle guidance result from the various strengths and 
weaknesses of humans and machines. 

Machines, for example, cannot react to unknown situations or interpret the movements 
of children (see Chap. 20). In comparison, humans can be inattentive, judge distances and 
speeds badly and their eyes only see a restricted field of vision [29]. 
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17.5.2.1 Machine Versus Human Perception Limits and Consequences 
for Testing 

To illustrate the limited performance of technological perception compared to that of 
humans, a heavily simplified model of currently used sensor technologies is described 
below. Sensors are needed for a vehicle to be able to collect information about its 
environment, and are classifiable according to their physical measuring principle. The 
automobile sector mainly uses radar, lidar, near and far infrared, ultrasound sensors, and 
cameras. The upper and center image of Fig. 17.8 show simplified and color-coded the 
limited machine perception of individual measuring principles. Compared with this, the 
lower image superimposes all these above-named measurements onto what humans per- 
ceive among difficult light- and weather conditions (sun, backlight, wet road surface, 
spray/splashing water, icing/contamination of windshield/sensors, road markings only 
partially visible). Close investigation reveals that the lefthand radar reflection point (blue) 
is a false detection, caused by a reflection in the opposite lane (see [40, 41]). 

Figure 17.8 illustrates that the outcome of machine perception and interpretation of 
complex traffic situations continues to present development engineers with considerable 
technical challenges. These include detecting static and dynamic objects, physically 


Fig. 17.8 Machine versus 
human perception (upper 
image radar in blue with lidar 
in yellow, center image 
addition with camera-image 
processing in green and red, 
lower image overlay machine 
with human perception). Image 
rights: Author 
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measuring them as accurately as possible, and allocating the correct semantic meaning to 
the detected objects (see Chap. 20). 

Difficult light- and weather conditions challenge human and machine perception in real 
traffic situations. For this purpose area-wide accident data analyzes (see Sect. 17.4.3.2) are 
able to indicate temporally and geographically related accident black spots. To analyze 
scenarios considering reduced visibility due to fog, rain, snow, darkness and glare from sun 
or headlights, the author carried out a fist-of-its-kind area-wide accident study in cooper- 
ation with Christian Erbsmehl from Fraunhofer Institute for Traffic and Infrastructure 
Systems (IVI) in Dresden. One finding of the case-by-case analysis was that in 95 % of all 
cases no evasive actions to avoid accidents were documented. Only in | % of the cases 
drivers were able to reduce the consequences of a collision by evasive maneuvers. Other 
evasive maneuvers failed (4 %). Figure 17.9 presents results of this study with relevant 
geographical accident scenes for virtual, proofing ground, and field tests of automated 
vehicles covering all police reports in Saxony from the years 2006 to 2014. 
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Fig. 17.9 Area-wide geographically related traffic accident scenes with difficult weather conditions 
and reduced visibility for human and machine perception (Geographical data © state-owned 
enterprise geo basic information and measurement Saxony 2015). Image rights: Author 
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17.5.2.2 Human Error Versus Machine Incertitudes 

Advancing vehicle automation of the main driver tasks result in new research questions. 
Attentive and vigilant drivers have substantial skills to deescalate dangerous traffic situ- 
ations. Human’s capabilities provide significant input for traffic safety today. Differenti- 
ated potential-benefit estimates would need to compare the performance of humans and 
machines. Especially take-over situations between driver and machine involve new 
challenges for design and validation of human-machine interaction. Initial tests at the 
professorial chair of Klaus Bengler, professor for ergonomics at the Technical University 
of Munich (TUM) demonstrate relevant ergonomic design requirements which will be 
continued [42]. 

Fundamental correlations between automation and human performance can be evalu- 
ated by many methods. It is possible to identify the probability of a road accident by the 
use of a fault tree. Amongst others the probability includes human failure, inappropriate 
behavior and the existence of a conflicting object [43]. The choice of actions to avoid a 
collision is greater if the potential road accident is less imminent. 

The evaluation of driver behavior requires observations for a longer period. Regarding 
human failures analyzing the perception process chain provides in-depth knowledge. Such 
analyzes draw on evaluations of psychological data from road accidents [44]. In terms of 
interdisciplinary accident analyzes, an error classification of five categories has been 
approved by practical experience in accident research. This five-steps method is a further 
development of ACASS (Accident Causation Analysis with Seven Steps). It was devel- 
oped jointly with GIDAS along the lines of the seven-step principle by Jens Rasmussen, 
former system safety and human factors professor in Denmark, a highly influential expert 
within the field of safety science, human error, risk management and accident research 
[45]. Using the five-steps method it is possible to identify human errors, define the time 
during the perception process from accessing the information to operation, and to evaluate 
the particular type of error (see Fig. 17.10). The associated questions concern: Information 
Access (was the relevant information of the traffic-situation objectively accessible to the 
driver? Was the field of vision clear?), Information Reception (did the driver observe the 
traffic situation properly and perceive/detect the relevant information subjectively?), Data 
Processing (did the driver correctly interpret the traffic situation according to the available 
information?), Objective Target (did the driver make a decision appropriate to the traffic 
situation?), and Operation (did the driver carry out his or her decision into operation 
properly?). 

Using this classification, the accident analysis shows that the predominant sources of 
human error lie in Information Access and Reception (see Fig. 17.10, [25, 46]). 

For machine perception, Klaus Dietmayer, professor in Ulm at the Institute of Mea- 
surement, Control, and Microtechnology, Expert for Information fusion, Classification, 
Multi-Object Tracking, Signal processing and Identification (see Chap. 20) names three 
essential domains of incertitudes corresponding to human Information Access as well as 
Data Processing. These three are: firstly State-, secondly Existence-, and thirdly Class 
uncertainty. All three have a direct impact on machine performance. If the uncertainties in 
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Fig. 17.10 Distribution of human error in road traffic (see [25, 46]). Image rights: Author 


these areas increase beyond a yet to be defined “tolerable limit”, errors in the automatic 
vehicle guidance can be expected. In terms of making forecasts, currently only an indi- 


cation of trends is possible. 


While the currently known methods for estimating state and existence uncertainties do not 
enable a current estimation of the capability of the machine perception, in principle it is not 
possible to predict degeneration in the capability of individual sensors or even a failure of 


components. (see Chap. 20) 


17.5.3 Potential Safety Benefits of Fully Automatied Vehicles 


in Inevitable Incidents 


When analyzing the potential safety benefits of fully automated vehicles, it is also 
important to consider persistent risks in the area of complex traffic situations and today’s 
known inevitable incidents. These include accidents at poorly visible and unclear inter- 
sections or behind visual obstructions. In a study of individual cases as part of a doctoral 
thesis at the University of Regensburg, visual obstruction was identified as a contributory 
cause in 19 % of all cases [44]. Examples include trees, bushes, hedges, and high grass. 
Obstructions for instance may also be the cause of an accident if a child is running out 
suddenly and unexpectedly in front of a car from between parked vehicles or a yard 


entrance. 


This especially includes errors in the sequences of the perception process, in the 


accessing and reaches its limits. 
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Due to the large number of possible and non-predictable events, especially the reactive 
actions of other road users, the uncertainties increase so strongly after around 2 s-3 s that 
reliable trajectory planning is no longer possible on this basis. (see Chap. 20) 


Therefore experience-based, internationally valid guidelines with virtual simulation 
methods for testing and verification of automated vehicles and final testing of the overall 
system limits in a real environment are recommended. This includes interaction tests with 
control algorithms and performance verification of real sensors in real traffic situations, 
particularly at the time just before a collision [47, 48]. 


17.6 Conclusion and Outlook 


The findings from road accident research confirm: human failure is the main cause of road 
accidents. This especially includes errors in the sequences of the perception process, in the 
accessing and reception of information. 

In order to estimate the potential safety benefits of highly and fully automated vehicles 
from accident data, a sophisticated comparison of the overall performance of humans and 
machines is required. This, however, will only be possible when precise knowledge is 
available concerning the functional characteristics and technical limits of developments 
planned for mass production. 

Statistically verified expert assessments have already proven the potential benefits of 
future safety-supporting vehicle- and driver assistance systems. Even before development 
has started, for instance, potential benefits can be estimated, and car manufacturers, due to 
the analysis and evaluation of road accidents, can also fulfill their product monitoring 
obligations. 

Overall, the results of road-accident analyzes today verifiably show that automating 
driving tasks from the “driver only”, “assisted”, up to “partially automated” driving 
categories are key technologies in contributing to minimizing the consequences of human 
failure. 

Forecasts for highly and fully automated vehicles, generated using traffic accident data, 
only give results based on numerous assumptions. A forecast of fully automated vehicles’ 
potential safety benefits came from a first Daimler accident-research appraisal that is based 
on several expert assumptions. According to Daimler’s estimates, practically complete 
elimination of accidents is possible by 2070—assuming successful market penetration. 
However, only accidents triggered by cars were looked at, and no consideration was given 
to physical limits and potential technical defects. This appraisal is thus based on some 
assumptions still to be refined and validated in a more detailed fashion in the future. 

Above all, current forecasting is still made difficult by technical challenges. Perceiving 
and interpreting complex traffic situations, in particular, faces considerable technical 
challenges for development engineers. Furthermore, human performance is often under- 
estimated. Assistance and partly automated systems essentially are able to compensate for 
weaknesses in human capacities according to findings from road-accident analyzes. 
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They can increase safety in routine human driving situations with supervision, warnings 
and lateral or longitudinal support. To further reduce the numbers of road accidents, 
driverless vehicles, on the other hand, at least must first match the driving skills of an 
attentive human driver, supported by assistance and partly automated systems, considering 
a series development. Only when these technical barriers have been overcome, can a 
large-scale rollout of marketable fully automated vehicles be expected. 


In summary, the following issues limit the validity of the potential safety benefit 


forecasts from “driver-only” to fully automated vehicles and will have impact for testing: 


The potential safety benefits stated for levels of automation so far (from driver-only to 
advanced functionalities) should be judged and used with care, depending on the data 
used. The validity and forecasting reliability of the data material both depend on the 
selection and evaluation of available parameters. 

Various approaches to evaluating potential benefits are to be compared with each other 
under expert consideration. Areas of action show the ideal maximum of possible 
preventable road accidents. In contrast to this is the actual identifiable efficiency, which 
is considerably lower. 

The validity of evaluation methods can vary greatly: it makes a significant difference 
whether an experienced accident reconstructor or analyst together with experts who 
have participated in all development processes of the current systems—in consultation 
with medics and psychologists—are involved or not. Such multi-layered background 
information allows him or her to get a complete overview of a complex accident 
incident and reconstruct or analyze it more precisely than a colleague without this 
detailed knowledge. 

There are often many overlapping areas of action within and between analyzes of 
potential benefits reducing the overall area of action. 

To obtain further findings for the development and design of safe automated vehicles 
(see Chap. 28), existing in-depth surveys of severe road accidents involving personal 
injury (e.g. GIDAS) should be combined with available area-wide accident collision 
data, digital geographic mappings, weather data and virtual traffic simulations (see 
Chaps. 15 and 16). 

Starting from the level highly automated and beyond, persons involved in an accident 
have—temporarily at least—no responsibility for the controllability of the vehicle. 
Measures to reduce risks and guarantee the functional safety of electrical and/or 
electronic systems are thus of prime importance. 

Fully automated vehicles’ degree of efficiency cannot currently be precisely quantified, 
as numerous technical and market-specific factors are still not known in detail. The 
evaluation of automated safety functions has to consider all possible system responses: 
True positive (or negative) and false positive (or negative). 

It may be assumed that individual accident scenarios may still arise as a result of 
increased degrees of automation, right up to full automation in spite of a 
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rule-consistent way of driving. This applies, for instance, to physical driving limits or 
time-critical situations, such as a child running suddenly in front of a vehicle. 

— Area-wide accident analyzes provide relevant scenarios for testing and verification of 
automated vehicles including virtual simulation methods, but final testing of the 
overall system limits in a real environment will not be completely eliminated. 


The potential safety benefits of fully automated vehicles are finally also based on the 
assumption that over 90 % of today’s road accidents can be put down to human error. 
Even if the technology of driverless cars never reaches 100 % perfection, and a few as yet 
unknown accident scenarios arise as a result, the vision of area-wide driverless-vehicle use 
in road traffic appears to promise a socially desirable benefit. Research activities that make 
use of interdisciplinary experts working on vehicle automation should therefore be pro- 
moted and strengthened. It is recommended to combine in-depth accident data with all 
worldwide geographically defined accident data collections, related weather, traffic, and 
vehicle operation data information taking into account data protection measures. This will 
lead to actual safety benefits and statistically relevant scenarios for development including 
validation or testing of automated driving pertaining to machine versus human perception. 
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Autonomous Vehicles and Autonomous 1 8 
Driving in Freight Transport 


Heike Flämig 


18.1 Introduction 


The degree of vehicle automation is continuously rising in all modes of transport both on 
public traffic infrastructure and in-house transport within company grounds, in order to 
improve the productivity, reliability, and flexibility of transport. Due to the growing 
information density and the complexity of the geographic division of labor, the idea of 
autonomous, decentralized local units is gaining in significance. By focusing on private 
passenger vehicles, however, public and scientific debate has until now neglected around 
one third of traffic on public roads, i.e. commercial traffic. Thereof, around one third is 
goods transportation, because the location of raw material or final goods production 
seldom coincides with the place of goods demand. Transport itself adds no value to the 
product. For this reason, applications where transport could take place without a driver 
were developed for in-house logistics as early as in the 1950s. The so-called driving robot 
was primarily developed for taking over special missions in dangerous or practically 
inaccessible situations. Automated, driverless and partially autonomous vehicles have 
therefore been in operation for transporting goods in production and logistics systems for 
a long time. 

In essence, the question can be asked to what extent fully automated vehicles can also 
be meaningfully used in road freight transport on public infrastructure. This is connected 
to further questions such as how much sense it makes to bring in such technology, what 
are the necessary technological, organizational and legal conditions, but also how logis- 
tics, supply chains and freight transport may change as a result. 
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This chapter firstly approaches these questions from the historical perspective of 
in-house logistics, as this provides a clear understanding of companies’ motivations for 
implementing driverless transport systems and the individual experience of company 
decision-makers’. Using case studies from the field of logistics and freight transport, this 
chapter will examine current fields of application and, wherever possible, the navigation 
and safety concept required for autonomous driving as well as control. Moreover, it will 
outline specific use cases for freight transport based on the generic descriptions in Chap. 2. 
Other autonomous systems developing in parallel, such as drones, show that completely 
new business models are developing in the field of logistics. Expected changes in logistic 
processes and in human labor in the systems will be discussed using a generic supply 
chain approach. The chapter will conclude by making recommendations and suggestions 
for further research. 


18.2 Development History of Driverless and Autonomous 
Transport Systems 


Automated guided transport (AGT) systems and automated guided vehicles (AGVs) were 
firstly used for commercial purposes in the early 1950s in the US and approximately ten 
years later in Germany [1]. The primary motivation was optimizing the flow of materials 
and reducing personnel, as a logical consequence of the ideas for raising productivity 
through improving work processes which had been spreading since the early 19th century 
(Frederick W. Taylor), from the timing of production processes (shaped in particular by 
Gilbreth’s “system of predetermined times”) to continuous assembly line production 
(Henry Ford). This development was driven by the mechanization of production due to an 
increasing focus on technology by management, to the point of envisioning complete 
automation (see the historical development in [1]). Beginning with the automation of 
transfers between production processes, the first AGT systems were used in production 
and warehouses. Compared to automated conveyance systems, such as conveyor belts, the 
investments are generally significantly lower and the flexibility with regard to changes in 
the material flow is considerably higher [2]. Transport is regarded as an unproductive 
activity, but must nevertheless demonstrate high reliability in production and warehouse 
systems. 


18.2.1 Driverless Indoor Transport Systems 


Typical indoor applications of AGT systems connect production and assembly processes, 
incoming and outgoing goods areas as well as picking areas and warehouses. AGT 
systems and work robots, such as those for picking, palletizing, etc., are frequently 
combined in a single apparatus. In in-house logistics, the encounter between humans and 
AGT/AGV systems was therefore always envisioned since AGT/AGV systems generally 


18 Autonomous Vehicles and Autonomous Driving in Freight Transport 367 


perform other functions as well, for example supporting the picking process. Early per- 
sonal safety concepts worked with tactile, mechanical bars or bumpers [2]. Today, laser 
scanners are more widely used which, depending on the driving speed, can cover up to 
7 m [2] and are frequently combined with other sensor technologies. The stabilization 
level plays a relatively minor role in in-house transport as the company itself maintains the 
floor surface in a drivable state. 

In early systems, the guidance level in the indoor component of in-house transports was 
generally implemented with electrical conductors embedded in the floors. Today the 
following different types for position recognition and positioning can be distinguished [3]: 
On the one hand, this includes the physical guide, implemented either as an active 
inductive guide path, as a magnetic tape or optical guide path. On the other hand, tech- 
nologies for free navigation which utilize floor markings (metal, magnets, transponders) or 
laser technology in which position-determination functions something like in maritime 
transport (cross bearing) can be found. Newer technologies combine laser scanners and 
camera systems with digital-environment maps and enable navigation by characteristics of 
the environment. 

Data transmission between the stationary and mobile units of an AGT system was 
previously conducted using inductive or infrared data transmission. Today, narrowband 
and increasingly broadband transmission (WLAN) are predominant. Radio direction 
finding enables localization via indoor GPS (Global Positioning System) with an accuracy 
up to 0.5 m, with outdoor GPS precise to within 10 m, dGPS (Differential GPS) accurate 
up to | m and dGPS with phase evaluation precise to within 0.1 m. 

Vehicles are assigned to driving tasks and are coordinated [2]. The control concept 
consists of a control unit through which execution of the transport order, transport order 
processing, vehicle allocation and transport execution are managed centrally. The traffic 
control system is part of the vehicle job execution. Clearance for individual sections of the 
route is done similarly to the rail traffic system in block sections that can only be occupied 
by one vehicle at a time. 

One such system was implemented in the distribution center of a logistics service 
provider in 2011 [3]. In the picking process, AGT systems are used in which the pickers 
are carried by the vehicle as well. The safety of the picker is ensured through various 
measures, as with the safety regulations for rail transport in which passengers are required 
to assume a particular position with their hands and feet. It is therefore not possible to 
carry out other activities while the vehicle is in motion. The operator safety concept relies 
on laser scanners. Navigation relies on a magnetic point sequence guide system, and the 
control system utilizes wireless-technology for data transmission. 

The AGT/AGV control system is also handled centrally in the new systems. Expanding 
the systems is therefore always associated with major expenses, so research into auton- 
omous, decentralized control solutions is afoot here as well. 

One current example is the autonomous reach forklift truck developed in the “marion 
(mobile, autonomous, cooperative robots in complex value creation chains)” project, 
which in turn was developed as part of the “Autonomik” (autonomous and 
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simulation-based systems for SMEs) technology program. The tasks of vehicles are 
assigned by a superordinate system. The forklift executes the task autonomously and 
calculates and determines the optimal route independently. It is equipped with a 3D-laser, 
laser scanner and cameras for 3D environment detection. Through sensors, the forklift can 
precisely assess the environment, the object dimensions and its spatial position. 

One example of a decentralized control system has been developed in the project 
“decentralized, agent-based self-control of automated guided transport systems” [4]. In 
this system, various agents are modeled for each vehicle. Route planning and task 
assignment take place cooperatively. Simulations showed a reduction in the overall route 
distances of all AGVs, a roughly 8 % drop in the empty trip share, a 22 % decrease of lead 
times and a minor increase of the utilization rate of the AGVs [5]. At the 
Fraunhofer-Institute for Material Flow and Logistics (IML), a cellular transport system 
based on swarm intelligence was developed in the “Swarm Intelligence for Logistics” 
project. In this system, the swarm (the means of transport) receives the transport jobs, the 
nearest vehicle takes on the job and dynamically determines the shortest path. 


18.2.2 Outdoor Automated Guided Vehicles on Private Property 


Outdoor applications for autonomous vehicles on private property are AGT systems for 
heavy transports or in-plant shuttle traffic are common, as the following examples 
demonstrate. 

At a container terminal, automated guided vehicles move containers between the 
container cranes and the stacking area [6]. The objective is to shorten routes, reduce empty 
trips and achieve optimal utilization of all resources. Transponders installed in the ground 
are used for positioning. Route planning is done independently, as are battery changes. 
Coordinating control is conducted via radio data transmission. 

In Germany, a major cooperation behind driverless trucks is a company that was 
originally active in the radio technology sector. In 2012, for example, this company 
implemented a driverless truck-shuttle between the production and logistics buildings on 
the factory grounds of a dairy company [7]. Loading and unloading of the pallets laden 
with fresh products and packaging materials are done automatically. The lane-guidance 
system utilizes transponders in the pathway. A sensor is installed beneath the towing 
vehicle that uses the markings on the floor for orientation and route determination. Aided 
by steering rear axles, the vehicles can drive small envelopes and achieve positioning 
precision to within 2 cm. Laser scanners scan the environment and together with contact 
switch strips and emergency stop buttons ensure the safety of people, goods and the 
vehicle itself. 

The “Sichere autonome Logistik- und Transportfahrzeuge (SaLsA)” [Safe autono- 
mous logistics and transport vehicles”] project led to further developments that made the 
encounter between AGT systems, trucks and people in the outdoor environment safer [8]. 
In the outdoor environment, the safety concept consists of radar sensors, since laser 
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scanners are not permitted there. The cooperative scanning of the environment through 
mobile and stationary sensors enables safe operation even at higher speeds (economic 
viability). 


18.2.3 Autonomous Vehicles for Road Freight Transport Outside 
of Plant Grounds 


The development of autonomous vehicles for freight transport and logistics outside of 
plant grounds is primarily conducted on a problem-oriented basis. So called driving robots 
were developed for use in dangerous situations, e.g. for disarming munitions, or for use in 
difficult-to-access areas such as deep-sea exploration, work on mountain sides or in dense 
forests and remote areas such as for work in the mining sector. 

Very large automated trucks with a maximum load capacity of 290 metric tons have 
been used at one of the world’s largest iron-ore mines in Australia since the 1990s [9]. The 
reason for their development was primarily difficulties in staffing, the dangerous shift 
work in the outback and the demanding logistical requirements in terms of personnel 
planning and staff transfer. 

Navigation is done via radar and lasers as well as through the use of waypoints for 
orientation. Monitoring and intervention options are possible via an operation center using 
wireless transmission. Control is carried out via GPS and dead reckoning, such as in ships 
or aircraft, through continuous position determination by means of measuring the course, 
speed and time. 


18.2.4 Development of Autonomous Driving and Autonomous 
Vehicles in Other Means of Transport 


Other means of transport, in which technical systems for stabilization, navigation (e.g. 
digital maps) and environment cognition are used have also seen increasing degrees of 
automation. 

Aircrafts have been equipped with stabilization systems since the early 20th century, 
autopilot functions are a long-established feature and the first drones in Germany are 
already in use in military, police and firefighting applications. Unmanned aerial systems or 
unmanned aerial vehicles (UAVs) are also used in civil applications in other countries, 
replacing for example ranchers and inspectors in remote areas. Drones monitor and seed 
fields and perform pest control functions. Small drones are already in use in Germany as 
well, for example for inspecting damage caused by storms or fires, in film productions and 
industrial inspections. Deutsche Bahn (the by far largest German railway company) is 
currently testing drones for monitoring vehicles and infrastructure. There are also pilot 
studies under way in the area of transporting commercial goods, in particular packages. 
With a carrying capacity of up to 2.5 kg and a range of approximately 15 km, current 
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drones could for example be used to deliver food or medications. A drone that can be used 
to transport a defibrillator has also been tested. The use of drones for commercial purposes 
over 5 kg has been generally permitted in many federal states, albeit not in controlled 
airspace [10]. 

Initial studies about unmanned maritime transport are currently under way (see e.g. the 
European research project MUNIN). Unmanned submarines have been used for some 
time. Concepts for drone ships are developed by various actors. One concept resembles 
platooning (see Sect. 18.3.4) in road traffic [11]. Here, in contrast to air traffic, it is 
possible to have crews boarding vessels at any time for example in heavily traveled areas 
such as the approaches to ports. As a rule, these systems will not act entirely autono- 
mously, even not in the future. Although evasive maneuvers can be carried out inde- 
pendently, it can be presumed that centralized monitoring and remote controlling will 
remain standard practice, though the two instances need not be one and the same. 

Remote control of driverless railway systems has been in place for years. Autonomous 
driving would include free navigation and would only be useful for very small units. To 
date, attempts to introduce smaller freight transport units on railways such as the Car- 
goSprinter have been unsuccessful. In part, this is due to the fact that there is no fast 
technology for train composition, thus separate power transmission is required for each 
carriage. This deficiency was addressed with the RailCab concept [12]. Here, autonomous, 
linear motor-driven vehicles use the wheel and track system. The train composition is 
carried out through an electronic drawbar. This is expensive and there are few suitable 
applications in which a truck could not perform the transport. On the main carriage routes, 
efficiency gains through economies of scale speak against non-prescheduled routing and 
variable convoy formation. But there could be economically viable applications on 
non-electrified branch lines. To date, however, there are no known studies comparing the 
environmental and economic implications under market conditions. 


18.2.5 Interim Conclusion 


AGT systems consist of a guidance control system, in particular for order assignment and 
route planning, a communication system and the vehicles [4]. Automated guided transport 
systems and vehicles (AGTS/AGV) for in-house transport with low levels of automation 
have been in existence for a long time. The degree of automation has risen with 
advancements in technology, albeit in different ways than in public road transportation. 
For example, the applicable Machinery Directive for the design of such systems clearly 
defines the safety concepts. In the past it was sufficient for the AGTS/AGV in in-house 
logistics to be able to move in a forward direction, generally in sceneries in which people 
were accustomed to driverless vehicles. In some cases people and vehicles are physically 
separated. In sum, the safety concepts are restricted to a minimum as the AGT/AGV 
systems operate at low speeds and in known, clearly defined circumstances. 
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Technological advancements focused on the correct execution of transport tasks and 
associated other tasks such as loading and unloading the cargo. Nevertheless, it may be 
presumed that the requirements with regard to the flexibility of AGT/AGV systems will 
rise as production moves away from linear assembly lines and the production and picking 
systems themselves become more flexible. At present, autonomous systems based on the 
agent technology seem best suited for the processing of increased data volumes and rising 
complexity, due to the decentralization of data provision and decision-making processes. 

Outdoor solutions for freight transport are based on conventional road vehicles and to 
date have only been in regular use on private company grounds. There are only few use 
cases to speak of to date. But similar developments to the indoor area are generally 
conceivable. 

The question with AGT/AGV systems then is how the autonomy of the units will 
develop in the future. Automatic control and driverless movement have by definition 
always been elements of AGT/AGV systems. The degree of autonomy is defined as the 
number of degrees of freedom. This depends, for example, on the free selection of the 
route and speed to move independently to a destination even in changing environmental 
situations. 

The use of mobile machines represents a point of contact between work robots and 
vehicles. Just as with in-house transport systems, the transport task is frequently combined 
with other “productive” tasks. These are mostly remotely operated systems. Thus, 
autonomous decision-making in terms of route determination is generally not the case. 
This also seems unlikely to generate added value in the majority of possible applications. 

In the early stages, the conceptual outline for automation solutions depended very 
strongly on the use context. These historical system elements are generally also found in 
the newer conceptual approaches, in particular with regard to the vehicle and operator 
safety concepts. It was only with the advent of decentralized concepts utilizing the new 
information and communication technologies that these different system solutions have 
been able to converge. In particular in situations in which high flexibility and speed are 
demanded, the technological solutions are becoming increasingly similar. They do differ 
in terms of the degree of autonomy, though. 


18.3 Use Cases in the Field of Autonomous Freight Transport 


Building on the experiences described here, the following will sketch potential applica- 
tions for autonomous vehicles in the field of freight transport using the generic use cases 
described in Chap. 2. The focus is on the transport of a specific good in road freight traffic. 
Potential applications in further segments of commercial transportation such as passenger 
transportation and goods transport in the context of production (self-driving work 
machines) are not examined here. 

Based on a conceptual description of the respective use case and in light of the specific 
features, an initial estimation of the benefits, opportunities and risks of introducing such a 
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technology will be discussed. The examination will begin, however, with a consideration 
of the degrees of automation in driving for freight transport, in order to better distinguish 
the implications of the various use cases. 


18.3.1 Excursus: Degrees of Automation in Autonomous Freight 
Transport 


To assess the necessity and benefits of a certain degree of automation in freight transport, 
first we will return to the definition of the driving task according to [13], whereby it is 
described as follows: The safe execution of the driving task requires information and 
knowledge regarding the traffic situation on the guidance level, the driving surface on the 
stabilization level, as well as the road network on the navigation level. Safe conduct of the 
vehicle requires steering, acceleration and braking as well as decisions regarding speed 
and course for longitudinal and lateral control of the vehicle. The decisions required for 
this are made on the basis of information regarding environmental conditions and the 
associated knowledge of the action to be taken. 

The German Federal Highway Research Institute categorizes automated driving into 
four development levels [14]: assisted driving (1), partially automated driving (2), highly 
automated driving (3) and fully automated driving (4). In the first three levels, the system 
performs partial aspects of the driving task for a specific time and/or in specific situations. 
But the driver is available at least as a supervisory organ. For the last level of fully 
automated driving (4), [14] presumes that the vehicle is navigating freely and no driver is 
required as a fallback level. 

In the area of freight transport, automated guided transport systems exist even on low 
automation levels. With an intermediate level between (3) and (4), another relevant variant 
in transport practice can be observed: The vehicle is highly automated and driverless, but 
free navigation does not occur. In many cases, the vehicle is controlled remotely by an 
operator via a control center. 


18.3.2 Use Cases for Autonomous Freight Transport 


Assisted and partially automated systems are already common in series-production 
vehicles. They take over longitudinal and/or lateral control of the vehicle for a certain 
period of time and/or in specific situations. In the assisted systems, the driver is warned; in 
partially automated systems, the system assumes control. The impetus—for example 
braking—must still be provided by the driver. The most well-known driver assistance 
systems (DAS) are anti-lock brake systems (ABS) and electronic stability programs 
(ESP). Due to severe road accident, lane-change assistants, lane-departure warning sys- 
tems and adaptive cruise control functions became mandatory for new vehicles ahead of 
schedule in 2013. Other systems are in development or are already ready for production, 
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such as anti-rollover systems, cornering systems or parking systems. They are primarily 
focused on assisting the driver on the guidance and stabilization levels. 

Highly and fully automated vehicles can also navigate freely; they are situation- and 
infrastructure-independent. Fully automated systems can function without a driver. Not 
only activities on the navigation level are assumed by the driving robot, but also the 
activities that are necessary to return the system to a minimal-risk state when components 
fail. 

From the perspective of freight traffic and logistics, technological solutions for the 
stabilization and guidance levels are therefore not the primary focus. Of greater interest 
are the potential use cases with and without drivers and free navigation. A closer 
examination is conducted on the following distinctions in the use cases: 


1. Interstate Pilot as highly automated highway driving with a driver and free 
navigation; 

2. Vehicle On Demand as highly automated highway driving without a driver and with 
free navigation; 

3. Full Automation Using Driver for Extended Availability—Follow-me Vehicle as 
highly automated driving without a driver and without free navigation (missing use 
case 3/4), 

4. Valet Parking as highly automated driving without a driver and without free navi- 
gation (missing use case 3/4). 


In the following, the use cases will be introduced and initial arguments for and against 
the respective degree of autonomy in logistics and freight transport are presented. In each 
case it will be assessed to what extent the use cases in the freight traffic system coincide 
with the “Use Cases of Autonomous Driving” (see Chap. 2) for private transportation, 
what differences exist and what the implications of such differences are for 
implementation. 


18.3.3 Interstate Pilot with Driver and Free Navigation 


Interstate pilot describes the use case in which an autopilot function is used, but a driver is 
available at all times. The driver hands over the stabilization and guidance level (and thus 
also navigation) to the autopilot, ideally after specifying a destination address. The use of 
an interstate pilot is intended between entering and exiting the interstate. The driver 
assumes control when confronted with unclear driving situations (e.g. construction zones). 

The posited benefits of the interstate pilot are provided by the reduction of accidents 
and an improved traffic flow. Particularly in traffic jams or stop-and-go traffic situations, 
but also on long, monotonous journeys, as well as due to the ever-increasing time-pressure 
of modern life, drivers are often close to their performance limits. In addition to unburden 
the driver from stressful driving situations, the interstate pilot also creates free time that 
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can be used for other purposes. Here there are deliberations as to whether activities such as 
route planning and fleet management might not also be decentralized. 

A first case of application has been already reported from as early as 1987, when the 
University of the Armed Forces in Munich, Germany, was experimenting with a lorry 
driving on a motorway [15]. In 2013, the vehicle-manufacturer Scania presented a truck 
that could “independently accelerate, brake and steer” up to a speed of 50 km/h [16]. In 
2014, Daimler had a truck driving up to 85 km/h amid other vehicles on a closed section 
of interstate [17]. 

The envisioned interstate pilot is essentially enabling fully automated driving. Due to 
safety considerations, however, the concept still depends on an available driver, which in 
effect reduces the scenario to being only highly automated. The effective top speed and the 
higher maximum permissible mass together require different safety concepts than in 
private transportation. 

Changes are expected primarily in terms of the job description of the driver. To date, 
drivers have been obliged to learn much about vehicle technology and securing loads. 
Would the driver continue to perform the technical inspection of the vehicle? What 
economic and environmental benefits would be associated with the concept? 


18.3.4 Vehicle on Demand Without a Driver and with Free 
Navigation 


Vehicle on demand most closely resembles the use case, which, in the field of freight 
transport, is known as an autonomous, decentralized AGT/AGV system. A driver’s seat is 
not envisioned. However, in the use case outlined in Chap. 2 the vehicle can operate at 
speeds of up to 120 km/h and in unknown scenarios. 

There is some reason to believe that the “vehicle on demand” use case comes very 
close to the conception of autonomous vehicles in freight transport desired by companies 
in the industry: The local-language-speaking driver who is willing to undertake long 
interstate journeys with long periods of absence and irregular working hours for low pay is 
ever-more-difficult to find. Overtired truck drivers are the most common cause of severe 
accidents. Docking and maneuvering in tight delivery situations is always a tricky task for 
the driver. 

The use of automation technology could therefore be of great benefit. However, the 
approval of all scenarios for heavy trucks will take time, in particular due to safety 
concerns and required changes in the supply chain (see Sect. 18.4). 

More likely is the realization of the interstate pilot without a driver and with free 
navigation between rendezvous points in the medium term, for example between rest areas 
on highways or between well-connected commercial zones. The likelihood of imple- 
mentation of this use case could be increased through the following enhancement 
concepts: 
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Safety concerns due to the lack of a driver on the fallback level could be mitigated by 
having separate highway entrances and exits for autonomous vehicles, as this would 
reduce encounters with other vehicles to a minimum. A dedicated lane for autonomous, 
coupled vehicles could probably avoid these concerns entirely. At the same time, such a 
dedicated lane could be the starting point for an extended concept with alternative drive 
technology, if the lane were, for example, outfitted with an overhead contact line for 
supplying electricity. 

The coupling of vehicles (platooning) would combine the initial concept of having a 
driver available in the lead vehicle as a backup with the extended concept in which 
vehicles drive autonomously without drivers and utilize the benefits of each concept. The 
platooning vehicles would be connected via a software system. Implementing the 
so-called electronic drawbar at high speeds would enable not only improved utilization of 
the road infrastructure, but above all reduced fuel consumption and emissions due to 
reduced wind resistance. 

Numerous tests have been carried out with the electronic drawbar since the mid-1990s 
[e.g. the European projects “CHAUFFEUR I and II”, “Safe Road Trains for the Envi- 
ronment (SARTRE)”, “Cooperative mobility solution for supervised platooning (COM- 
PANION)”, the Californian “PATH Program”, the German “KONVOI-Projekt: 
Entwicklung und Untersuchung des Einsatzes von elektrisch gekoppelten Lkw-Konvois 
auf Autobahnen”, and the Japanese “ITS Project” by the New Energy and Industrial 
Technology Development Organization (NEDO)]. In these projects, multiple trucks or a 
convoy of lead trucks and following passenger cars safely drove at up to 90 km/h with a 
minimum gap of 4 m. The systems were based on surveillance by radar sensors, stereo 
cameras, three-dimensional maps and usually also data exchange with other vehicles. 
Previous trials were always conducted with a driver in the lead vehicle and with or without 
drivers for extended availability in the following vehicles. There are already ideas under 
consideration for a driverless lead vehicle. 

As a tule these projects build on proven existing technology: adaptive cruise control 
systems integrated in series-production vehicles serve to maintain the gaps between the 
vehicles. Data transmission between the lead and following vehicle is frequently 
conducted via wireless-transmission or infrared technology. 

The measured fuel savings and CO;-reduction potential differed depending on the 
selected vehicle-to-vehicle (V2V) communication (in “off-center” mode), the type and 
construction of the lead vehicle and following vehicles, the gap, the speed as well as the 
road and environmental conditions (surface, temperature, inclines, altitude). The differ- 
ence was roughly 5 % for the lead truck and 10-15 % for the following passenger vehicles 
[18]. 
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18.3.5 Full Automation Using Driver for Extended Availability— 
Follow-Me Vehicle 


In the use case presented in Chap. 2, the vehicle takes fully automated control whenever 
the situation is approved for that mode. The driver is at any time available and can resume 
vehicle control if necessary. In practice it is an extension of the interstate pilot in terms of 
approved situations and the permissible speed and is very similar to autonomous driving. 

This use case is only interesting from an economic perspective if the accompanying 
driver can pursue value-creating activities during the drive. The next delivery could be 
prepared or processed from an administrative standpoint during the drive itself. Such 
vehicle concepts would also be conceivable for use in commercial passenger traffic, for 
example for activities in elderly care, the insurance industry, etc., which involve docu- 
mentation and administrative work. 

The “EmiL” concept study of a partially autonomous delivery vehicle in 2011 can be 
regarded as a sort of preliminary stage of development before full automation [19]. In this 
concept, the delivery person does not need to continually get in and out of the vehicle, but 
can instruct the vehicle via mobile phone to drive next to him at walking speed (follow-me 
function). For all unknown situations (e.g. merging situations, intersections), there is the 
additional DriveStick mode in which the vehicle can be driven at up to a speed of 6 km/h. 
The use of a local wireless-connection precludes signal interruptions that are feared and 
can indeed occur with GPS connections. 

The research project determined a time-saving of about 40 min over a one-day delivery 
period. The typical injury risk of twisting or rolling an ankle when getting out of the 
vehicle is also reduced. 


18.3.6 Valet Parking—Valet Delivery 


Valet parking refers to the use case in which the autopilot independently navigates the 
vehicle to a previously assigned parking spot. The concept presented in Chap. 2 assumes 
that this could be possible in the public sphere at speeds of up to 30 km/h. One example 
could be autonomous driving from a driver’s place of residence to a defined parking spot. 
This use case is scarcely conceivable in the context of freight transport, however, as there 
are truck-parking locations rarely connected via the secondary road network. 

Much more likely is a scenario in which the autopilot would take over in tight 
inner-city areas and industrial and retail delivery zones not designed for large trucks and 
park or dock the truck independently. This could prevent expensive car damages to occur. 
The driver would be relieved of stressful driving tasks, which would be particularly 
advantageous in light of the driver’s remaining responsibility for long, exhausting high- 
way drives. Valet delivery could also help drivers comply with legal rest times if the “last 
mile” could be conducted without their assistance. 
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Another potential use case could be delivery to construction sites. In major construc- 
tion jobs, trucks are increasingly held in so-called waiting zones in the vicinity of the 
construction site. These processes could be optimized if drivers in large-scale 
concrete-pouring actions could concentrate on their runs and the wait times were elimi- 
nated. The autopilot would take over driving between the waiting point and the con- 
struction site. 

From a legal standpoint, implementation would depend heavily on the distance 
between the waiting point and site as well as the concrete scenario. Otherwise imple- 
mentation would seem to be more of a mental than a technical challenge. In particular 
from the driver’s perspective, who would be confronted with scenarios in which it is 
essentially alleged that he or she does not handle their working tool with the required 
skills. 


18.4 Changes in the Supply Chain Resulting from a Higher 
Degree of Automation in Freight Transport 


A systematic examination of the changes in the supply chain resulting from a higher 
degree of automation in freight transport can be seen in the generic supply chain depicted 
in Fig. 18.1. Every supply chain consists of a succession of the activities “raw material 
extraction”, “processing/production”, “trade”, and the intermediate logistical processes 
“goods issue (handling)”, “transport”, and “goods receipt (handling)”. Moreover, under 
the current conditions of production and retail logistics, it is equally interesting to consider 
the effects of a lacking driver since a lot of added-value-services are performed by the 
logistics providers in those scenarios. 

Aside from driving itself, “transport” requires inspection of the vehicle, route planning 
as well as documentation and other administrative tasks (shipping documents) taken over 
by the driver. These activities are even more comprehensive in the case of cross-border 
traffic (customs). With highly automated, driverless or fully automated driving, the 
common problem of driving and rest-period violations would become obsolete and routes 
could be planned differently. If transports were conducted in a highly-automated manner, 
the driver would be expected to perform other tasks in this period, for example performing 
route planning, fleet management or simply resting [21]. 

In other words, it could lead to both a decentralization and parallelization of functions. 
The use of the transport time for other activities is not new, however. For example, postal 
shipments were previously handled in trains (postal trains), and the same phenomenon can 
be observed today, in mobile depots (e.g. repurposed double-decker buses, “floating 
warehouse systems”). 

The driver must always supervise the driving task and sometimes takes over person- 
ally. At the goods issue point, he or she is responsible for checking the shipping papers 
and securing the load. At the goods receipt point, he or she is responsible for demanding a 
receipt confirmation. 
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Fig. 18.1 Example of driver-relevant activities in a generic supply chain. Source Author, based on 
[20] 


Today, in goods issue and receipt, in many supply chains the driver is responsible for 
loading and unloading the vehicle. The driver’s responsibility frequently ends at the 
loading ramp, but in some cases only after placement of the goods in the receiving facility, 
or even after pre-sorting, internal transport and shelving of the material (in some cases in 
temporary storage locations). As in earlier times, for some parcel and letter delivery 
operations it is common for the driver to pick the orders himself. 

In the field of production, conceivable applications would include own-account 
transport in which—similarly to the in-house segment—transport jobs are tendered and 
autonomous trucks could “apply” for and win the transport jobs based on predefined 
criteria. In this case neither a central control function nor route determination is required. 
Some gates already have freight locks, making workforce obsolete in place at the transfer 
of risk. 

If the driver no longer “accompanies” the vehicle, his or her activities would have to be 
performed by others. Companies then would have once again to hire or train own staff for 
such activities. The logistics companies might also opt for a different business model to 
account for these changes. This could lead to a general revaluation of work and the 
creation of local jobs, particularly in urban areas. In other cases, however, a further 
increase in the degree of automation in goods receipt and issue departments could be 
envisioned. 
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Changes in the transport systems themselves can be expected primarily at the contact 
points between unmanned and manned driving as well as in the task profile of drivers. The 
changes to processes in rail and maritime traffic as well as in the spectrum of activities 
performed by humans do not seem overly serious. The driver is removed from the sce- 
nario and replaced by an autopilot. The remaining technology in trains and ships has 
heretofore been excluded from any proposed changes. Also, new job descriptions could 
emerge, for example if the aspect of security against pirates in sea transport were to be 
given greater weight than the navigation aspect. 


18.5 Initial Microeconomic Assessments of Automated Systems 
in the Freight Transport Chain 


From a microeconomic perspective, a lack of driving personnel, an energy-saving driving 
style, high reliability and accident evasion are significant reasons to employ autonomous 
systems in the freight transport chain. In some industries, the material flow from goods 
receipt to the production lines and eventual goods issue are already highly automated and 
driverless, which eliminates interruptions and idle times. Loading and unloading from 
warehouses is also highly automated and driverless in some sectors. In some cases, the 
control of warehousing and production is coordinated and ranges from automated goods 
receipt to automated goods issue. 

The development of radio frequency identification (RFID) technology and the redis- 
covery of Leonardo da Vinci’s idea of learning from nature (bionics) inspired a debate on 
independent control and led to an intensive debate on the decentralization and 
decision-making autonomy of technical systems. Aided by technological developments in 
cost-effective sensors and internet-aided software systems, the degree of automation has 
risen continuously. The latest systems in production and warehouses have come to rely on 
independent control (“internet of things”) of the vehicles and conveyor systems, which 
can react autonomously to changing requirements, states and environmental conditions. 

Based on the extremely advanced degree of automation of in-house AGT/AGV 
systems in some industries, further shifts of the human role towards conceptual and 
supervisory activities can be expected. The use of driverless vehicles in the entire 
logistical system can be expected to lead to a reorganization of processes in many supply 
chains (see Sect. 18.4). However, automation will continue to grow only in particular 
industries as the relation between costs and benefits is not equally favorable in all sectors. 

Within the transport system in the public space, the lack of a driver and/or the driver’s 
changing role will lead to additional interfaces that need to be designed according to 
certain requirements. The driver getting in and out of the vehicle requires additional stops. 
In the in-house field, there is already substantial experience to draw upon, for example, 
with regard to picking. In the traffic systems, such experience is limited. In maritime 
shipping, for example, it is quite common that a port skipper is taking over active control 
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of the ship when entering the port area. In the road freight traffic system, the predominant 
transshipment systems generally involve changing the trailer rather than the driver. These 
systems have many advantages such as quick transfer times for materials and goods, and 
results in increasing productive times of the vehicles. They also improve the working 
conditions for the drivers, who can return to their local branches daily. In practice, 
however, this only works in large networks or in partnership-type relationships with 
trustworthy and reliable partners. This applies not only to punctuality, but also with 
respect to the securing of the load. To date, the most widespread use of these systems has 
been with the large integrators and courier, express and parcel (CEP) service providers 
specialized on the transshipment of standardized packages. 

For the implementation of driverless transport chains in road freight transport, then 
there are also questions of cost and liability in transport law that need to be clarified, going 
beyond questions of technical compatibility of the autonomous vehicles with the infras- 
tructure and with other vehicles or platooning trucks. 

If damages to the goods or vehicle occur due to system failure, product liability comes 
into play (for details, see Chap. 25). It follows that autopilots, consisting of hardware 
components (sensors, processors and actuators) and software components must be 
constructed in such ways that potential damages can be traced to the individual compo- 
nents and thus their producers. 


18.6 Initial Macroeconomic Assessments of Automated 
Systems in the Freight Transport Chain 


Judging from a macroeconomic perspective as well, automated systems could provide an 
approach to resolve structural deficits in the current transport system. In times of tight 
public budgets, a significant expansion of the traffic infrastructure, and in particular rail 
and inland waterways, is not likely to occur in the near future. 

Automated driving, with its minimal space requirements and rather equal speed levels, 
could at least double the existing average road infrastructure capacity. Moreover, it could 
contribute to achieving environmental policy goals, as automated driving reduces fuel 
consumption. Already today, driver assistance systems make a significant contribution to 
reducing traffic accidents. Such accidents could also be avoided by the use of highly and 
fully automated vehicles, as they can recognize the ends of traffic jams, avoid risky 
overtaking maneuvers and entirely eliminate wrong-way driving. However, the questions 
concerning legal liability in the event of an accident have not yet been exhaustively 
resolved. 

In the case of platooning, a professional driver could be used in the lead vehicle, as is 
envisioned in most of the projects. This approach has the advantage of enabling even 
unpracticed long-haul drivers (beginners, the elderly) to join a convoy. This would also 
require that freight and passenger vehicles have the ability to communicate with each 
other. 
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However, it is not only technological determinism that offers strong arguments against 
automated road vehicles: Efficiency increases in road traffic also give rise to conflicts with 
mass transport systems. Automated platooning stands in direct competition with the 
railways, as did long trucks before them. Although at present there is a lack of profes- 
sional truck drivers in Germany, the overall number of professional truck drivers would 
decrease, and in other countries with high unemployment, much-needed jobs would be 
lost. 

Moreover, public acceptance of fully automated systems is limited—not least due to 
continuous reports of failures of mechanical or electronic components in vehicles, or the 
fear of unstable data connections. Autonomous vehicles therefore would also have to be 
equipped with reliable software (artificial intelligence) that can respond to all eventualities 
—in particular when humans and animals are present on the roads. 

Also judging from a legal perspective, autopilots outside of factory grounds are a 
novelty. Previous AGT/AGV systems were handled according to the Machinery Direc- 
tive, with stringent vehicle and operator safety concepts. An expansion of the sphere of 
action (private/public) and the operating speeds (walking speed to highway speeds) of the 
systems could necessitate new laws or adjustments to the existing legal framework. 

The use of autonomous vehicles in road traffic would require abolishment of the legal 
restrictions set forth in the Vienna Convention on Road Traffic which stipulates that a 
driver must maintain control over the vehicle at all times. There have been recent 
developments in this regard in the United States, where the law has been adapted to permit 
deviation from the control requirement insofar as the system “can be overridden or 
switched off by the driver.” If this legal stance were to be accepted in Europe as well, it 
would mean that there has to be a superordinate actor that can always intervene in 
controlling the vehicle. In the areas of rail, maritime and air traffic, the systems are already 
designed in this manner, and for rail and air traffic there are accepted superordinate actors. 
For road freight traffic, such an actor must still be created. Public acceptance is also yet to 
be ensured. 


18.7 Conclusion and Outlook 


Since the 1960s, (driverless) automated guided transport (AGT) systems have been in use 
in in-house logistics in Germany. However, these systems have not received sufficient 
attention either in the media or in transport research. In in-house logistics, for example, 
transponders are used as waypoints that can also store information. If vehicles in the 
public space would always have to recognize all environmental features and special 
characteristics of every route, appropriate cost-intensive hardware and software systems 
would be required. This could be avoided if waypoints would provide certain information 
that could be read-out temporarily. In this context, extrapolated to the transport system, 
the question arises as to how the road infrastructure would have to be changed. 


382 H. Flämig 


Fully automated driving creates the opportunity to steer vehicles between the departure 
point and the destination without human intervention. The autopilot performs not only the 
stabilization and guidance tasks, but also navigation, and thus is also responsible for 
ensuring accident-free driving. 

The assessment of the current situation with respect to the development of autonomous 
road traffic systems made clear that passenger and freight traffic must be viewed in a much 
more integrated fashion. It would also be interesting to have a closer look at autonomous 
system development with regard to other means of transport. Autopilots in aircrafts have 
long been the norm. As early as the beginning of the twentieth century, stabilization 
systems were used in aviation. Drones are already being used. The first studies on the 
European level of unmanned maritime transport are under way. Remote control of trains 
has been in use for years as well. What is new is the quality of autonomous 
decision-making in the case of changing environmental situations and changing driving 
and transport orders. The expanding fields of application, for instance through drones in 
the aviation sector, highlight the importance of completely rethinking the distribution of 
transport jobs across the different means of transportation. More research is needed here. 

Many exciting insights and new developments could be expected if the broad field of 
commercial passenger traffic would be studied in greater detail. Much alike in freight 
transport, it is concerned with mobility in exercising a profession. Since moving from one 
location to another is only a means to perform a service at the destination, in most cases 
mobility itself is regarded much more pragmatically, compared to individual mobility. 

The combination of partial scenarios of individual, autonomous logistics processes to 
form a comprehensive autonomous supply chain from automated raw material extraction 
and all phases of production and logistics to product delivery to the end customer requires 
an integrated approach. Technologically speaking, tremendous progress has been realized 
in recent years. Research should therefore focus primarily on the (required) degree of 
automation for individual logistics processes as well as on elucidating the micro-and 
macroeconomic benefits and costs of those developments. 

Due to the open legal questions and the lack of acceptance of both the general public 
and to some extent of corporate decision-makers for the use of autonomous systems in 
road freight transport (as well as to some extent in other transport systems), gradual, 
step-by-step introduction seems to be the only realistic approach. It will therefore depend 
on finding the right cascade approach and implementation strategy. To date, specific 
deliberations on the respective implementation aspects of the outlined use cases are 
missing. 

On first glance, it appears reasonable to combine some of the solution approaches 
currently being discussed with regard to increasing the capacity of the infrastructure, 
economical use of resources and environmental protection. Starting to introduce auton- 
omous driving in closed transport systems (e.g. transport in system cooperation) and 
manageable scenarios (e.g. interstate, airport grounds, ports) will help to overcome 
reluctance concerning the technologies as well as lacking standardization. The 
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step-by-step implementation of platooning, starting with manned lead and following 
vehicles, could build the requisite acceptance among the general public. It must be 
examined whether the simultaneous introduction of overhead electricity-powered trucks 
and thus the creation of a dedicated lane would be sensible in view of capacity and safety 
requirements. 

However, even platooning raises several follow-up questions, in particular regarding 
decision-making and the distribution of benefits: If the fuel savings depend on a vehicle’s 
position in the convoy, who decides which position each vehicle has in the chain? If the 
convoy drove without drivers in the following vehicles, who would pay for the driver in 
the lead vehicle? Would the lead driver require more/special training than the other 
drivers? Prior to introduction, it would also be necessary to clarify how other platooning 
vehicles can be identified. A common standard would have to be developed to ensure that 
the other vehicles are also trustworthy. Here the need for further study and the recom- 
mendations for action are closely interrelated. 

Changes in the supply chain and freight transport show a highly ambivalent picture that 
must be examined in greater detail. For the relating understanding, assessment and 
categorization, it must be clarified which technological changes and challenges will arise 
for the driving task itself. It is also essential to identify in greater detail the advantages and 
disadvantages of using automated vehicles compared to conventional vehicles as well as 
their integratability in the existing work environment, by analyzing different job profiles in 
the commercial environment. To date, the question of what can be transported autono- 
mously and what degree of autonomy would be accepted from industry with regard to 
necessity, cost and flexibility remains unanswered. 

At the same time, there are also additional opportunities for innovative business 
models, which, however, have yet to be developed and evaluated. Also alternative 
applications are conceivable whose challenges until today seemed unsurmountable. One 
example of this is the provision of supply and disposal services to inner-city locations 
(“city logistics”), which is characterized by conflicts and high costs. The use of autono- 
mous road transport vehicles, together with other components (e.g. goods lock system) 
could for instance resolve temporal conflicts between freight and passenger traffic. 

At the same time, the opportunities and risks associated with the rising automation of 
transport should be analyzed in greater detail from a macroeconomic, cross-border per- 
spective. This includes not only legal matters and the need for standardization, but also the 
potential loss of low-level jobs. This must be analyzed in terms of alternative 
labour-market scenarios. Also, to date insufficient attention has been paid to the conflicts 
that could potentially arise between autonomous road freight transport (in convoys) and 
means of mass transportation. Finally, the discussion must be expanded thematically, in 
order to achieve the best comprehensive assessment of environmental and resource 
considerations. 
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Abstract 

This chapter discusses the operational and economic aspects of autonomous 
mobility-on-demand (AMoD) systems, a transformative and rapidly developing mode 
of transportation wherein robotic, self-driving vehicles transport customers in a given 
environment. Specifically, AMoD systems are addressed along three dimensions: 
(1) modeling, that is analytical models capturing salient dynamic and stochastic 
features of customer demand, (2) control, that is coordination algorithms for the 
vehicles aimed at throughput maximization, and (3) economic, that is fleet sizing and 
financial analyses for case studies of New York City and Singapore. Collectively, the 
models and methods presented in this chapter enables a rigorous assessment of the 
value of AMoD systems. In particular, the case study of New York City shows that the 
current taxi demand in Manhattan can be met with about 8000 robotic vehicles 
(roughly 70 % of the size of the current taxi fleet), while the case study of Singapore 
suggests that an AMoD system can meet the personal mobility need of the entire 
population of Singapore with a number of robotic vehicles roughly equal to 1/3 of the 
current number of passenger vehicles. Directions for future research on AMoD systems 
are presented and discussed. 
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19.1 Introduction 
19.1.1 Personal Urban Mobility in the Twenty-First Century 


In the past century, private automobiles have dramatically changed the paradigm of 
personal urban mobility by enabling fast and anytime point-to-point travel within cities. 
However, this paradigm is currently challenged due to a combination of factors such as 
dependency on oil, tailpipe production of greenhouse gases, reduced throughput caused 
by congestion, and ever-increasing demands on urban land for parking spaces [1]. In the 
US, urban vehicles consume more than half of the oil consumed by all sectors [2], and 
produce 20 % of the total carbon dioxide emissions [3, 4]. Congestion has soared dra- 
matically in the recent past, due to the fact that construction of new roads has not kept up 
with increasing transportation demand [5]. In 2011, congestion in metropolitan areas 
increased urban Americans’ travel times by 5.5 billion hours (causing a 1 % loss of 
US GDP [6]), and this figure is projected to increase by 50 % by 2020 [6]. Parking 
compounds the congestion problem, by causing additional congestion and by competing 
for urban land for other uses. The problem is even worse at a global scale, due the 
combined impact of rapid increases in urban population (to reach 5 billion, more than 
60 % of the world population, by 2030 [7]), worldwide urban population density, and car 
ownership in developing countries [1]. As a result, private automobiles are widely rec- 
ognized as an unsustainable solution for the future of personal urban mobility [1]. 


19.1.2 The Rise of Mobility-on-Demand (MoD) 


The challenge is to ensure the same benefits of privately-owned cars while removing 
dependency on non-renewable resources, minimizing pollution, and avoiding the need for 
additional roads and parking spaces. A lead to a solution for this problem comes from 
realizing that most of the vehicles used in urban environments are over-engineered and 
underutilized. For example, a typical automobile can attain speeds well over 100 miles per 
hour, whereas urban driving speeds are typically slow (in the 15- to 25-miles per hour 
range [5, 8]). Furthermore, private automobiles are parked more than 90 % of the time [5]. 
Within this context, one of the most promising strategies for future personal urban 
mobility is the concept of one-way vehicle sharing using small-sized, electric cars (re- 
ferred to as MoD), which provides stacks and racks of light electric vehicles at closely 
spaced intervals throughout a city [1]: when a person wants to go somewhere, she/he 
simply walks to the nearest rack, swipes a card to pick up a vehicle, drives it to the rack 
nearest to the selected destination, and drops it off. 

MoD systems with electric vehicles directly target the problems of oil dependency 
(assuming electricity is produced cleanly), pollution, and parking spaces via higher uti- 
lization rates. Furthermore, they ensure more flexibility with respect to two-way rental 
systems, and provide personal, anytime mobility, in contrast to traditional taxi systems or 
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Fig. 19.1 Left figure A Car2Go vehicle used in a traditional (i.e., non-robotic) MoD system. Right 
figure Self-driving vehicle that Google will use in a 100-vehicle AMoD pilot project within the next 
two years. Image credit: Car2Go and Google 


alternative one-way ridesharing concepts such as carpooling, vanpooling, and buses. As 
such, MoD systems have been advocated as a key step toward sustainable personal urban 
mobility in the twenty first century [1], and the very recent success of Car2Go (a one-way 
rental company operating over 10,000 two-passenger vehicles in 26 cities worldwide [9]) 
seems to corroborate this statement (see Fig. 19.1, left). 

MoD systems, however, present a number of limitations. For example, due to the 
spatio-temporal nature of urban mobility, trip origins and destination are unevenly dis- 
tributed and as a consequence MoD systems inevitably tend to become unbalanced: 
Vehicles will build up in some parts of a city, and become depleted at others. Addi- 
tionally, MoD systems do not directly contribute to a reduction of congestion, as the same 
number of vehicle miles would be traveled (indeed more, considering trips to rebalance 
the vehicles) with the same origin-destination distribution. 


19.1.3 Beyond MoD: Autonomous Mobility-on-Demand (AMoD) 


The progress made in the field of autonomous driving in the past decade might offer a 
solution to these issues. Autonomous driving holds great promise for MoD systems 
because robotic vehicles can rebalance themselves (eliminating the rebalancing problem at 
its core), autonomously reach charging stations when needed, and enable system-wide 
coordination aimed at throughput optimization. Furthermore, they would free passengers 
from the task of driving, provide a personal mobility option to people unable or unwilling 
to drive, and potentially increase safety. These benefits have recently prompted a number of 
companies and traditional car manufacturers to aggressively pursue the “AMoD technol- 
ogy,” with activities ranging from the design of vehicles specifically tailored to autono- 
mous mobility-on-demand (AMoD) operations [10, 11], to the expected launch by Google 
of a 100-vehicle AMoD pilot project within the next two years [12] (see Fig. 19.1, right). 
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Rapid advances in vehicle automation technologies coupled with the increased eco- 
nomic and societal interest in MoD systems have fueled heated debates about the potential 
of AMoD systems and their economic and societal value. How many robotic vehicles 
would be needed to achieve a certain quality of service? What would be the cost for their 
operation? Would AMoD systems decrease congestion? In general, do AMoD systems 
represent an economically viable, sustainable, and societally-acceptable solution to the 
future of personal urban mobility? 


19.1.4 Chapter Contributions 


To answer the above questions, one needs to first understand how to control AMoD 
systems, which entails optimally routing in real-time potentially hundreds of thousands of 
robotic vehicles. Such routing process must take into account the spatiotemporal vari- 
ability of mobility demand, together with a number of constraints such as congestion and 
battery recharging. This represents a networked, heterogeneous, stochastic decision 
problem with uncertain information, hence complexity is at its heart. Within this context, 
the contribution of this chapter is threefold: 


1. We present a spatial queueing-theoretical model for AMoD systems capturing salient 
dynamic and stochastic features of customer demand. A spatial queueing model entails 
an exogenous dynamical process that generates “transportation requests” at spatially- 
localized queues. 

2. We outline two recent, yet promising approaches for the analysis and control of AMoD 
systems, which leverage the aforementioned spatial queueing-theoretical model. The 
first approach, referred to as “lumped” approach, exploits the theory of Jackson net- 
works and allows the computation of key performance metrics and the design of 
system-wide coordination algorithms. The second approach, referred to as “dis- 
tributed” approach, transforms the problem of controlling a set of spatially-localized 
queues into one of controlling a single “spatially-averaged” queue and allows the 
determination of analytic scaling laws that can be used to select system parameters 
(e.g., fleet sizing). 

3. We discuss two case studies for the deployment of AMoD systems in New York City 
and Singapore. These case studies suggest that it is much more affordable (and con- 
venient) to access mobility in an AMoD system compared to traditional mobility 
systems based on private vehicle ownership. 


The chapter concludes with a discussion about future directions for research, with a 
preliminary discussion about the potential of AMoD systems to decrease congestion. The 
results presented in this chapter build upon a number of previous works by the author and 
his collaborators, namely [13] for the lumped approach, [14-17] for the spatial 
queueing-theoretical framework and the distributed approach, and [13, 18] for the case 
studies. 
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The rest of this chapter is structured as follows. Section 19.2 presents a spatial 
queueing model for AMoD systems and gives an overview of two complementary 
approaches to control AMoD systems, namely, the lumped approach and the distributed 
approach. Section 19.3 leverages analysis and control synthesis tools from Sect. 19.2 to 
provide an initial evaluation of AMoD systems for two case studies of New York City and 
Singapore. Section 19.4 outlines directions for future research, with a particular emphasis 
on (and some preliminary results for) congestion effects. Finally, Sect. 19.5 concludes the 
chapter. 


19.2 Modeling and Controlling AMoD Systems 
19.2.1 Spatial Queueing Model of AMoD Systems 


At a high level, an AMoD system can be mathematically modeled as follows. Consider a 
given environment, where a fleet of self-driving vehicles fulfills transportation requests. 
Transportation requests arrive according to an exogenous dynamical process with asso- 
ciated origin and destination locations within the environment. The transportation request 
arrival process and the spatial distribution of the origin-destination pairs are modeled as 
stochastic processes, leading to a probabilistic analysis. Transportation requests queue up 
within the environment, which gives rise to a network of spatially-localized queues 
dynamically served by the self-driving vehicles. Such network is referred to as “spatial 
queueing system.” Performance criteria include the availability of vehicles upon the 
request’s arrival (i.e., the probability that at least one vehicle is available to provide 
immediate service) or average wait times to receive service. The model is portrayed in 
Fig. 19.2. 

Controlling a spatial queueing system involves a joint task allocation and scheduling 
problem, whereby vehicle routes should be dynamically designed to allocate vehicles to 
transportation requests so as to minimize, for example, wait times. In such a dynamic and 
stochastic setup, one needs to design a closed-loop control policy, as opposed to 


Fig. 19.2 A spatial queueing 1 
model of an AMoD system A1— 9000 
entails an exogenous dynamical 
process that generates 
“transportation requests” 
(yellow dots) at spatially- 
localized queues. Self-driving 
vehicles (represented by small 
car icons) travel among such 
locations according to a given 
network topology to transport 
customers 


Aı = Arrival rate of 
requests at queue 1 
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open-loop preplanned routes. The problem combines aspects of networked control, 
queueing theory, combinatorial optimization, and geometric probability (i.e., probabilistic 
analysis in a geometrical setting). This precludes the direct application of “traditional” 
queueing theory due to the complexity added by the spatial component (these complex- 
ities include, for example, congestion effects on network edges, energy constraints, and 
Statistical couplings induced by the vehicles’ motion [17, 19, 20]). It also precludes the 
direct application of combinatorial static optimization, as the dynamic aspect of the 
problem implies that the problem instance is incrementally revealed over time and static 
methods can no longer be applied. As a consequence, researchers have devised a number 
of alternative approaches, as detailed in the next section. 


19.2.2 Approaches for Controlling AMoD Systems 


This section presents two recent, yet promising approaches for the control of spatial 
queueing systems as models for AMoD systems, namely the lumped approach and the 
distributed approach. Both approaches employ a number of relaxations and approxima- 
tions to overcome the difficulties in directly applying results from queueing (network) 
theory to spatial queueing models. A remarkable feature of these approaches is that they 
yield formal performance bounds for the control policies (i.e., factor of sub-optimality) 
and scaling laws for the quality of service in terms of model data, which can provide 
useful guidelines for selecting system parameters (e.g., number of vehicles). These 
approaches take their origin from seminal works on hypercube models for spatial queues 
[19], on the Dynamic Traveling Repairman problem [20-23], and on the Dynamic Traffic 
Assignment problem [24, 25]. 

Alternative approaches could be developed by leveraging worst-case (as opposed to 
stochastic) techniques for dynamic vehicle routing, e.g., competitive (online) analysis 
[26-28]. This is an interesting direction for future research. 


19.2.2.1 Lumped Approach 

Within the lumped approach [13], customers are assumed to arrive at a set of stations 
located within a given environment," similar to the hypercube model [19]. The arrival 
process at each station is Poisson with a rate A, where i € {1, ..., N} and N denotes the 
number of stations. (Reasonable deviations from the assumption of Poisson arrivals have 
been found not to substantially alter the predictive accuracy of these models [19].) Upon 
arrival, a customer at station i selects a destination j according to a probability mass 


‘Alternatively, to model an AMoD system where the vehicles directly pick up the customers, one 
would decompose a city into N disjoint regions Q1, Q2, ..., On. Such regions would replace the 
notion of stations. When a customer arrives in region Q;, destined for Q,, a free vehicle in Q; is sent 
to pick up and drop off the customer before parking at the median of Q;. The two models are then 
formally identical and follow the same mathematical treatment. 
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Fig. 19.3 Left figure In the lumped model, an AMOD system is modeled as a Jackson network, 
where stations are identified with single-server queues and roads are identified with infinite-server 
queues. (Customers are denoted with yellow dots and servicing vehicles are represented by small car 
icons.) Some vehicles travel without passengers to rebalance the fleet. Right figure In a distributed 
model of an AMoD system, a stochastic process with rate 2 generates origin-destination pairs, 
distributed over a continuous domain Q 


function {p;;} (Fig. 19.3, left). If vehicles are parked at station i, the customer takes a 
vehicle and is driven to the intended destination, with a travel time modeled as a random 
variable T;;. However, if the station is empty of vehicles, the customer immediately leaves 
the system. Under the assumptions of Poisson arrivals and exponentially-distributed travel 
times, an AMoD system is then translated into a Jackson network model through an 
abstraction procedure [13, 29], whereby one identifies the stations with single-server 
queues and the roads with infinite-server queues. (Jackson networks are a class of 
queueing networks where the equilibrium distribution is particularly simple to compute as 
the network has a product-form solution [30, 31].) With this identification, an AMoD 
system becomes a closed Jackson network with respect to the vehicles, which is amenable 
to analytical treatment [13] (Fig. 19.3, left). 

To control the network, for example, to (autonomously) rebalance the vehicles to 
ensure even vehicle availability, the strategy is to add virtual customer streams [13]. 
Specifically, one assumes that each station i generates “virtual customers” according to a 
Poisson process with rate y;, and routes these virtual customers to station j with proba- 
bility aj. The problem of controlling an AMoD system becomes one of optimizing over 
the rates {w;} and probabilities {a,;} which, by exploiting the theory of Jackson networks, 
can be cast as a linear program (hence, this approach extends well to large transportation 
networks). This method encourages coordination but does not enforce it, which is the key 
to maintaining tractability of the model [13]. The rates {y;} and probabilities {a;;} are then 
used as feedforward reference signals in a receding horizon control scheme to control in 
real-time an entire AMoD system [13], as done for case studies of New York City and 
Singapore presented in Sect. 19.3. 


394 M. Pavone 


19.2.2.2 Distributed Approach 

The key idea behind the distributed approach [14-17] is that the number of stations 
represents a continuum (i.e., N — 00), similar to the Dynamic Traveling Repairman 
problem [20-23]. In other words, customers arrive at any point in a given bounded 
environment [15, 16], or at any point along the segments of a road map [15]. In the 
simplest scenario, a dynamical process generates spatially localized origin-destination 
requests in a geographical region Q C R°. The process that generates origin-destination 
requests is modeled as a spatiotemporal Poisson process, namely, (i) the time between 
consecutive generation instants has an exponential distribution with intensity A, and 
(ii) origins and destination are random variables with probability density functions, 
respectively, pọ and pp, supported over Q, see Fig. 19.3 (right). The objective is to 
design a routing policy that minimizes the average steady-state time delay between the 
generation of an origin-destination pair and the time the trip is completed. By removing 
the constraint that customers’ origin-destination requests are localized at a finite set of 
points in an environment, one transforms the problem of controlling N different queues 
into one of controlling a single “spatially-averaged” queue. This considerably simplifies 
analysis and control, and allows one to derive analytical expressions for important design 
parameters. For example, one can show that a necessary and sufficient condition for 
stability is that the load factor 


P = AEgoey[¥ — X] + EMD(P0@p)| (vm) (19.1) 


is strictly less than one, where m is the number of servicing vehicles, v is the average 
speed of the vehicles, Ey,,,[Y — X] is the expected distance between origin and desti- 


nation locations, and EMD(@g¢@p) is the earth mover’s distance between densities po and 
Pp [32], representing the minimum distance, on average, a vehicle must travel to realign 
itself with an asymmetrical travel demand [16]. Intuitively, if distributions pọ and pp are 
imagined as describing two piles each consisting of a unit of “dirt” (i.e., earth), then 
EMD(pPo Pp) can be thought of as the minimum work (dirt X distance) required to 
reshape po into pp (see [32] for a formal definition). One can use the above formula to 
estimate the required fleet size to ensure stability—an example application to a case study 
of Singapore is presented in Sect. 19.3. With this approach, it is also possible to obtain 
formal performance bounds (i.e., factors of sub-optimality) for receding horizon control 
policies, in the asymptotic regimes p — 1” (heavy-load, system saturated) and p — 0* 
(light-load, system empty of customers) [17, 33]. 


19.2.3 Comparison 
The lumped approach and the distributed approach are complementary in a number of 


ways. Both models provide formal guarantees for stability and performance. The former 
is more realistic (a road topology can be readily mapped into this model) and provides a 
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natural pathway to synthesize control policies. The latter provides significant mathemat- 
ical simplifications (as one only needs to study a spatially-averaged queue) and enables 
the determination of analytic scaling laws that can be used to select system parameters 
(e.g., fleet sizing). In the next section we exploit the interplay between these two 
approaches to characterize AMoD systems for case studies of New York City and 
Singapore. 

Both approaches appear to be promising tools to systematically tackle the problem of 
system-wide control of AMoD systems. Several research questions, however, still need to 
be addressed to fulfill this objective, particularly with respect to inclusion of congestion 
effects (in Sect. 19.2.2.1, roads are modeled as infinite server queues, so the travel time for 
each vehicle is independent of all other vehicles), predictive accuracy, and control syn- 
thesis for complex scenarios, as detailed in Sect. 19.4. 


19.3 Evaluating AMoD Systems 


Leveraging models and methods from Sect. 19.2, this section studies hypothetical 
deployments of AMoD systems in two major cities, namely New York City and Singa- 
pore. Collectively, the results presented in this section provide a preliminary, yet rigorous 
evaluation of the benefits of AMoD systems based on real-world data. We mention that 
both case studies do not consider congestion effects—a preliminary discussion about these 
effects is presented in Sect. 19.4. 


19.3.1 Case Study I: AMoD in New York City 


This case study applies the lumped approach to characterize how many self-driving 
vehicles in an AMoD system would be required to replace the current fleet of taxis in 
Manhattan while providing quality service at current customer demand levels [13]. In 
2012, over 13,300 taxis in New York City made over 15 million trips a month or 500,000 
trips a day, with around 85 % of trips within Manhattan. The study uses taxi trip data 
collected on March 1, 2012 (the data is courtesy of the New York City Taxi and 
Limousine Commission) consisting of 439,950 trips within Manhattan. First, trip origins 
and destinations are clustered into N = 100 stations, so that a demand is on average less 
than 300 m from the nearest station, or approximately a 3-min walk. The system 
parameters such as arrival rates {A;}, destination preferences {p;;} and travel times {T;;} 
are estimated for each hour of the day using trip data between each pair of stations. 
Vehicle availability (i.e., probability of finding a vehicle when walking to a station) is 
calculated for 3 cases peak demand (29,485 demands/h, 7-8 pm), low demand (1982 
demands/h, 4-5 am), and average demand (16,930 demands/h, 4-5 pm). For each case, 
vehicle availability is calculated by solving the linear program discussed in Sect. 19.2.2.1 
and then applying mean value analysis [29] techniques to recover vehicle availabilities. 
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Fig. 19.4 Case study of New York City. Left figure Vehicle availability as a function of system 
size for 100 stations in Manhattan. Availability is calculated for peak demand (7-8 pm), low 
demand (4-5 am), and average demand (4-5 pm). Right figure Average customer wait times over 
the course of a day, for systems of different sizes 


(The interested reader is referred to [13] for further details.) The results are summarized in 
Fig. 19.4. 

For high vehicle availability (say, 95 %), one would need around 8000 vehicles 
(~70 % of the current fleet size operating in Manhattan, which, based on taxi trip data, 
we approximate as 85 % of the total taxi fleet) at peak demand and 6000 vehicles at 
average demand. This suggests that an AMoD system with 8000 vehicles would be able to 
meet 95 % of the taxi demand in Manhattan, assuming 5 % of passengers are impatient 
and are lost when a vehicle is not immediately available. However, in a real system, 
passengers would wait in line for the next vehicle rather than leave the system, thus it is 
important to determine how vehicle availability relates to customer waiting times. Cus- 
tomer waiting times are characterized through simulation, using the receding horizon 
control scheme mentioned in Sect. 19.2.2.1. The time-varying system parameters 4;, Pij, 
and average speed are piecewise constant, and change each hour based on values esti- 
mated from the taxi data. Travel times T;; are based on average speed and Manhattan 
distance between stations i and j, and self-driving vehicle rebalancing is performed every 
15 min. Three sets of simulations are performed for 6000, 7000, and 8000 vehicles, and 
the resulting average waiting times are shown in Fig. 19.4 (right). Specifically, Fig. 19.4 
(right) shows that for a 7000 vehicle fleet the peak averaged wait time is less than 5 min 
(9-10 am) and, for 8000 vehicles, the average wait time is only 2.5 min. The simulation 
results show that high availability (90-95 %) does indeed correspond to low customer 
wait time and that an AMoD system with 7000-8000 vehicles (roughly 70 % of the size 
of the current taxi fleet) can provide adequate service with current taxi demand levels in 
Manhattan. 
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19.3.2 Case Study Il: AMoD in Singapore 


This case study discusses an hypothetical deployment of an AMoD system to meet the 
personal mobility need of the entire population of Singapore [18]. The study, which 
should be interpreted as a thought experiment to investigate the potential benefits of an 
AMoOD solution, addresses three main dimensions (i) minimum fleet size to ensure system 
stability (i.e., uniform boundedness of the number of outstanding customers), (ii) fleet size 
to provide acceptable quality of service at current customer demand levels, and (iii) fi- 
nancial estimates to assess economic feasibility. To support the analysis, three comple- 
mentary data sources are used, namely the 2008 Household Interview Travel Survey— 
HITS—(a comprehensive survey about transportation patterns conducted by the Land 
Transport Authority in 2008 [34]), the Singapore Taxi Data—STD—database (a database 
of taxi records collected over the course of a week in Singapore in 2012) and the Sin- 
gapore Road Network—SRD—(a graph-based representation of Singapore’s road 
network). 


19.3.2.1 Minimum Fleet Sizing 

The minimum fleet size needed to ensure stability is computed by applying Eq. (19.1), 
which was derived within the distributed approach. The first step is to process the HITS, 
STD, and SRD data sources to estimate the arrival rate A, the average origin-destination 
distance Ey,»,[¥ — X], the demand distributions pọ and @p, and the average velocity 
v. Given such quantities, Eq. (19.1) yields that at least 92,693 self-driving vehicles are 
required to ensure the transportation demand remains uniformly bounded. To gain an 
appreciation for the level of vehicle sharing possible in an AMoD system of this size, 
consider that at 1,144,400 households in Singapore, there would be roughly one shared 
car every 12.3 households. Note, however, that this should only be seen as a lower bound 
on the fleet size, since customer waiting times would be unacceptably high. 


19.3.2.2 Fleet Sizing for Acceptable Quality of Service 

To ensure acceptable quality of service, one needs to increase the fleet size. To charac- 
terize such increase, we use the same techniques outlined in Sect. 19.3.1, which rely on 
the lumped approach. Vehicle availability is analyzed in two representative cases. The first 
is chosen as the 2-3 pm bin, since it is the one that is the closest to the “average” traffic 
condition. The second case considers the 7-8 am rush-hour peak. Results are summarized 
in Fig. 19.5 (left). With about 200,000 vehicles availability is about 90 % on average, but 
drops to about 50 % at peak times. With 300,000 vehicles in the fleet, availability is about 
95 % on average and about 72 % at peak times. As in Sect. 19.3.1, waiting times are 
characterized through simulation. For 250,000 vehicles, the maximum wait times during 
peak hours is around 30 min, which is comparable with typical congestion delays during 
rush hour. With 300,000 vehicles, peak wait times are reduced to less than 15 min, see 
Fig. 19.5 (right). To put these numbers into perspective, in 2011 there were 779,890 
passenger vehicles operating in Singapore [35]. Hence, this case study suggests that an 
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Fig. 19.5 Case study of Singapore. Left figure Performance curve with 100 regions, showing the 
availability of vehicles versus the size of the system for both average demand (2-3 pm) and peak 
demand (7-8 am). Right figure Average wait times over the course of a day, for systems of different 
Sizes 


AMOD system can meet the personal mobility need of the entire population of Singapore 
with a number of robotic vehicles roughly equal to 1/3 of the current number of passenger 
vehicles. 


19.3.2.3 Financial Analysis of AMoD Systems 

This section provides a preliminary, yet rigorous economic evaluation of AMoD systems. 
Specifically, this section characterizes the total mobility cost (TMC) for users in two 
competing transportation models. In System 1 (referred to as traditional system), users 
access personal mobility by purchasing (or leasing) a private, human-driven vehicle. 
Conversely, in System 2 (the AMoD system), users access personal mobility by sub- 
scribing to a shared AMOD fleet of vehicles. For both systems, the analysis considers not 
only the explicit costs of access to mobility (referred to as cost of service—COS), but also 
hidden costs attributed to the time invested in various mobility-related activities (referred 
to as cost of time—COT). A subscript i = {1, 2} will denote the system under consid- 
eration (e.g., COS, denotes the COS for System 1). 

Cost of service: The cost of service is defined as the sum of all explicit costs associated 
with accessing mobility. For example, in System 1, COS, reflects the costs to individually 
purchase, service, park, insure, and fuel a private, human-driven vehicle, which, for the 
case of Singapore, is estimated for a mid-size car at $18,162/year. For System 2, one 
needs to make an educated guess for the cost incurred with retrofitting production vehicles 
with the sensors, actuators, and computational power required for automated driving. 
Based upon the author’s and his collaborators’ experience on self-driving vehicles, such 
cost (assuming some economies of scale for large fleets) is estimated as a one-time fee of 
$15,000. From the fleet-sizing arguments of Sect. 19.3.2.2, one shared self-driving vehicle 
in System 2 can effectively serve the role of about 4 private, human-driven vehicles in 
System 1, which implies an estimate of 2.5 years for the average lifespan of a self-driving 
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Table 19.1 Summary of the financial analysis of mobility-related cost for traditional and AMoD 
systems for a case study of Singapore 


Cost (USD/km) Yearly cost (USD/year) 

COS COT TMC COS COT TMC 
Traditional 0.96 0.76 1.72 18,162 14,460 32,622 
AMoD 0.66 0.26 0.92 12,563 4959 17,522 


vehicle. Tallying the aforementioned costs on a fleet-wide scale and distributing the sum 
evenly among the entire Singapore population gives a COS, of $12,563/year (see [18] for 
further details about the cost breakdown). According to COS values, it is more affordable 
to access mobility in System 2 than System 1. 

Cost of time: To monetize the hidden costs attributed to the time invested in 
mobility-related activities, the analysis leverages the Value of Travel Time Savings 
(VTTS) numbers laid out by the Department of Transportation for performing a Cost 
Benefit Analysis of transportation scenarios in the US. Applying the appropriate VTTS 
values based on actual driving patterns gives COT, = $14,460/year (which considers an 
estimated 747 h/year spent by vehicle owners in Singapore in mobility-related activities, 
see [18]). To compute COT;, this analysis prices sitting comfortably in a shared 
self-driving vehicle while being able to work, read, or simply relax at 20 % of the median 
wage (as opposed to 50 % of the median wage which is the cost of time for driving in 
free-flowing traffic). Coupling this figure with the facts that a user would spend no time 
parking, limited time walking to and from the vehicles, and roughly 5 min for a requested 
vehicle to show up (see Sect. 19.3.2.2), the end result is a COT, equal to $4959/year. 

Total mobility cost: A summary of the COS, COT, and TMC for the traditional and 
AMoD systems is provided in Table 19.1 (note that the average Singaporean drives 
18,997 km in a year [18]). Remarkably, combining COS and COT figures, the TMC for 
AMoD systems is roughly half of that for traditional systems. To put this into perspective, 
these savings represent about one third of GDP per capita. Hence, this analysis suggests it 
is much more affordable to access mobility in an AMoD system compared to traditional 
mobility systems based on private vehicle ownership. 


19.4 Future Research Directions 


This chapter provided an overview of modeling and control techniques for AMoD sys- 
tems, and a preliminary evaluation of their financial benefits. Future research on this topic 
should proceed along two main dimensions: efficient control algorithms for increasingly 
more realistic models and eventually for real-world test beds, and financial analyses for 
a larger number of deployment options and accounting for positive externalities 
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(e.g., increased safety) in the economic assessment. Such research directions are discussed 
in some details next, with a particular emphasis on the inclusion of congestion effects and 
some related preliminary results. 


19.4.1 Future Research on Modeling and Control 


A key direction for future research is the inclusion of congestion effects. In AMoD 
systems, congestion manifests itself as constraints on the road capacity, which in turn 
affect travel times throughout the system. To include congestion effects, a promising 
strategy is to study a modified lumped model whereby the infinite-server road queues are 
changed to queues with a finite number of servers, where the number of servers on each 
road represents the capacity of that road. This approach is used in Fig. 19.6 on a simple 
9-station road network, where the aim is to illustrate the impact of autonomously rebal- 
ancing vehicles on congestion. Specifically, the stations are placed on a square grid, and 
joined by 2-way road segments each of which is 0.5 km long. Each road consists of a 
single lane, with a critical density of 80 vehicles/km. Each vehicle travels at 30 km/h in 
free flow, which means the travel time along each road segment is | min in free flow. 
Figure 19.6 plots the vehicle and road utilization increases due to rebalancing for 500 
randomly generated systems (where the arrival rates and routing distributions are ran- 
domly generated). The routing algorithm for the rebalancing vehicles is a simple 
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Fig. 19.6 Top left Layout of the 9-station road network. Each road segment has a capacity of 40 
vehicles in each direction. Bottom left The first picture shows the 9-station road network without 
rebalancing. The color on each road segment indicates the level of congestion, where green is no 
congestion, and red is heavy congestion. The second picture is the same road network with 
rebalancing vehicles. Right The effects of rebalancing on congestion. The x-axis is the ratio of 
rebalancing vehicles to passenger vehicles on the road. The y-axis is the fractional increase in road 
utilization due to rebalancing 
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open-loop strategy based on the linear program discussed in Sect. 19.2.2.1. The x-axis 
shows the ratio of rebalancing vehicles to passenger vehicles on the road, which represents 
the inherent imbalance in the system. The red data points represent the increase in average 
road utilization due to rebalancing and the blue data points represent the utilization 
increase in the most congested road segment due to rebalancing. It is no surprise that the 
average road utilization rate is a linear function of the number of rebalancing vehicles. 
However, remarkably, the maximum congestion increases are much lower than the 
average, and are in most cases zero. This means that while rebalancing generally increases 
the number of vehicles on the road, rebalancing vehicles mostly travel along less con- 
gested routes and rarely increase the maximum congestion in the system. This can be seen 
in Fig. 19.6 bottom left, where rebalancing clearly increases the number of vehicles on 
many roads but not on the most congested road segment (from station 6 to station 5). 

The simple setup in Fig. 19.6 suggests that AMoD systems would, in general, not lead 
to an increase in congestion. On the other end, a particularly interesting and intriguing 
research direction is to devise routing algorithms for AMoD systems that lead to a de- 
crease in congestion with current demand levels (or even higher). A promising strategy 
relies on the idea that if AMoD systems are implemented such that passengers are given 
precise pickup times and trips are staggered to avoid too many trips at the same time, 
congestion may be reduced. Passengers may still spend the same amount of time between 
requesting a vehicle and arrival at their destination, but the time spent waiting for the 
vehicle could be used for productive work as opposed to being stuck in traffic. Specifi- 
cally, for highly congested systems, vehicle departures can be staggered to avoid exces- 
sive congestion, and the routing problem is similar to the simultaneous departure and 
routing problem [36]. 

Besides congestion, several additional directions are open for future research. As far as 
modeling is concerned, those include (i) analysis in a time-varying setup (e.g., with 
periodically time-varying arrival rates), (ii) inclusion of mesoscopic and microscopic 
effects into the models (e.g., increased throughput due to platooning or automated 
intersections), and (iii) more complex models for the transportation demands (e.g., time 
windows or priorities). On the control side, those include (i) inclusion of recharging 
constraints in the routing process, (ii) control of AMoD systems as part of a multi-modal 
transportation network, which should address synergies between AMoD and alternative 
transportation modes and interactions with human-driven vehicles, and (iii) deployment of 
control algorithms on real-world test beds. 


19.4.2 Future Research on AMoD Evaluation 


The AMoD evaluation presented in Sect. 19.3 already showed that AMoD systems might 
hold significant financial benefits. Remarkably, such financial benefits might be even 
larger when one also accounts for the positive externalities of an AMoD system, e.g., 
improved safety, freeing up urban land for other uses, and even creating a new economy 
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based on infotainment systems onboard the self-driving vehicles. Such additional benefits, 
however, have not been thoroughly characterized yet and require additional analyses. 
Another research direction involves the evaluation of AMoD systems for more complex 
deployment options, e.g., as a last-mile solution within a multi-modal transportation 
system, or with a more sophisticated service structure, e.g., multiple priority classes. 


19.5 Conclusions 


This chapter overviewed recent results regarding the modeling, control, and evaluation of 
AMOD systems. Case studies of New York City and Singapore suggest that it would be 
much more affordable (and more convenient) to access mobility in an AMoD system 
compared to traditional mobility systems based on private vehicle ownership. More 
studies are however needed to devise efficient, system-wide coordination algorithms for 
complex AMoD systems as part of a multi-modal transportation network, and to fully 
assess the related economic benefits. 
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Part IV 
Safety and Security 


Hermann Winner and Markus Maurer 


Autonomous driving must be safe—this demand’s legitimacy is beyond dispute. But what 
needs to be considered for this desired state to be achieved? Entry into this topic is via 
machine perception, which is ultimately viewed as an enabling technology for autono- 
mous driving. Naturally, only what is recognized as being certain can also be used in a 
decision on safe driving. Can it be ensured that machine perception exhibits the quality 
required for safety, and if so, how? What are the options for classifying perception 
performance onboard, what limits cannot be exceeded, and how are these to be evaluated 
for the development of autonomous driving? These are the core questions of Klaus 
Dietmayer’s chapter, Possibility of Predicting Machine Perception for Automated 
Driving. 

If the demands of autonomous vehicles have been successfully defined and imple- 
mented, there remains the challenge of verifying and validating whether these demands 
are really fulfilled in the present execution. Among the experts, there is unanimity that 
release for production cannot be given with today’s testing and validation methods. In 
their chapter, The Release of Autonomous Vehicles, Walther Wachenfeld and Hermann 
Winner explain the challenges and outline approaches that could form components of new 
tool chains for validating safety. 

At the beginning of their driving careers, even human beings’ driving skills are far 
from what they will be later on. The accident frequency of young (male) drivers in 
particular is witness to that. With growing experience, the safety of drivers improves 
considerably. People learn to drive safely. Under the title Do Autonomous Vehicles 
Learn?, and based on an intensive study of the literature, Walther Wachenfeld and 
Hermann Winner discuss the extent to which machine learning can meet autonomous 
driving’s safety requirements. 

Taking the pivotal ISO 26262 standard as his starting point, Andreas Reschka exam- 
ines when autonomous vehicles generally, and particularly in the use cases, are in a safe 
state; how degradations could be designed more safely; and what is required of a Safety 
Concept for Autonomous Vehicles. 
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In his article Opportunities and Risks Associated with Collecting and Making Usable 
Additional Data, Kai Rannenberg explains that, although open interfaces and communi- 
cation with participants outside the vehicle may be helpful from the point of view of 
validating safety and functionality, they may be very questionable in terms of data pro- 
tection and data integrity. He argues that machine autonomy may even be linked to a loss 
in privacy, though perhaps this need not be so. 


Predicting of Machine Perception 20 


for Automated Driving 


Klaus Dietmayer 


20.1 Introduction 


In the case of highly-automated and fully-automated driving it is necessary for the vehicle 
itself to recognize the limitations of its machine perception, as well as the functional 
limitations of processing modules based on this perception to react adequately. While 
simulator studies of highly-automated driving have shown that realistic transfer times to 
the driver of between 5 and 10 s can be assumed [1, 2] before the driver can reliably take 
over the driving task again, with fully-automated driving a human would not provide any 
backup whatsoever. In the case of functional limitations, the vehicle would have to be able 
to achieve an intrinsically safe state completely by itself. However, potential transfer times 
of 5 s and more require extensive autonomy of the vehicle, if only for a limited time, in 
order to be able to bridge this time period reliably under all circumstances. 

To be able to achieve this degree of autonomy, the vehicle must perceive its sur- 
roundings, interpret them appropriately and be able to derive and execute reliable actions 
continuously. Technically, this task is carried out by individual processing modules that 
build on each other. A simplified representation of the relationships is shown in Fig. 20.1. 

The machine perception of the vehicle’s surroundings is enabled by various sensors, 
such as cameras or radar sensors, incorporated into the vehicle. Further information about 
the static driving environment is usually added from very precise digital maps. However, 
this can only be used when the vehicle knows its exact position. Therefore, the vehicle 
also requires a self-localization functional module for the map matching. The result of the 
machine perception is a dynamic vehicle environment model in which the vehicle itself 
and all other road users are represented by individual dynamic motion models. This 
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Fig. 20.1 General structure of 
the information processing for 
automated vehicle driving. 
Image rights: Author has 
copyright 


Cameras 


Lidars 


Situation Detection 
Situation Prediction 
Action Planning 


Vehicle Control 


= 
2 
5 
a 
o 
fe) 
z 
© 
a 
© 
£ 
= 
o 
© 


(vehicle environment model) 
Trajectory Planning 


(D)GPS 


Localization 
(e.g. feature-based) 


Machine perception Situation comprehension Planning and 
and action planning vehicle control 


should also contain all the relevant infrastructure elements such as traffic signs and traffic 
lights, as well as structuring elements such as traffic islands and curbstones, road markings 
for dividing traffic lanes, closed areas or pedestrian crossings. 

Based on this vehicle environment model, during the situation recognition, all the 
individual components are set in relation to each other in order to generate a machine 
interpretation of the scene from the dependencies of the individual elements. In the 
situation prediction module based on this, various possible developments of the scene 
over time, also known as episodes, are calculated in advance and evaluated as to the 
probability of their occurrence. Therefore, in this document an episode refers to a possible 
specific development over time for a detected traffic scene, whereby the time horizon lies 
within the range of a few seconds. On the basis of this situational information, the module 
based on this determines the higher-level action planning. For example, it could stipulate 
driving around an obstacle or overtaking a slower vehicle. For the execution of the plans, 
possible trajectories of the vehicle are calculated with a typical time horizon of 3-5 s and 
are evaluated in terms of safety and comfort. The optimal trajectory based on the criteria 
that can be stipulated is executed by the vehicle control. The processing procedure 
described is repeated continuously, usually in line with the data capture of the sensors, so 
that the vehicle is able to react to the actions and reactions of other road users. 

The description of this technical process chain clearly shows that a failure of the 
machine perception would immediately lead to uncertainties in the situation evaluation of 
such a magnitude that reliable safe action planning and action execution would no longer 
be possible. The degradation of the machine interpretation of the scene and the action 
planning and action execution based on this depends on the situation; however, reliable 
prediction would typically not be able to exceed 2-3 s. Therefore, it is evident that a 
minimum perception capability is required even for highly-automated driving due to the 
significantly greater transfer times to the driver. A complete failure of the machine per- 
ception must be avoided in all circumstances, though of course this also applies to the 
modules based on it and the vehicle control with its sensors and actuators, which are not 
within the focus of this document, however. 
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Therefore, the question is whether limitations in the operation of the machine per- 
ception can be detected or even predicted, and if they are, over what period of time. In this 
context, the following sections will discuss the state of the technology of known 
methodical approaches, and on this basis derive possible research questions. 


20.2 Machine Perception 
20.2.1 Scope and Characteristic 


As described in the previous section, the task of machine perception is to reliably detect all 
the other road users relevant to the operation of the automated driving, and to assign them 
correctly to the traffic infrastructure. This is particularly necessary because, for example, a 
pedestrian at the side of the road presents a different potential risk than one who is using a 
separate pedestrian walkway running parallel to the road. 

For the machine perception sensors based on camera and radar and/or lidar technology 
are used. More detailed information on the operation and design of these sensors can be 
found in [3], for example. Cameras provide a 2D representation of a 3D scene in the form 
of high-resolution gray-scale or colored images, from which image processing methods 
can be used to extract individual objects when there is sufficient contrast or differentiation 
in the texture. However, the object distance can only be determined with mono cameras 
based on assumptions that often lead to errors, such as a flat surface. Although stereo 
cameras also enable the object distance to be determined by means of the disparity image, 
the accuracy decreases quadratically as the distance increases. With the currently pre- 
vailing base distances for the stereo arrangements and the resolution of the cameras, 
measuring ranges of up to around 50 m are possible without the error margin increasing to 
such an extent that functions could no longer make any use of the data. 

On the other hand, radar and also lidar sensors provide distance measuring data that is 
comparatively very accurate and also practically distance-independent in terms of the 
measuring error margin. However, due to their low angle resolution, they are less accurate 
in capturing the contours, i.e. the external dimensions of objects. This applies in particular 
to radar sensors. Additionally, radar and lidar sensors do not provide any texture infor- 
mation. Due to these different measuring properties, the different sensor types are gen- 
erally used in combination to create the machine perception. This is referred to as sensor 
data fusion. 

The combined sensor data enables moving and static objects, but also road surface 
markings, for example, to be categorically detected and physically measured. The possible 
measuring dimensions depend on the specific sensor set-up. Typical physical measured 
data that can be captured includes the dimensions of an object used for a box model with 
length, width and height, as well as its position absolutely in the world or relative to the 
vehicle. In the case of moving objects, the object speeds and object accelerations are 
added to this data. More difficult to determine, and generally very unreliably, from 


410 K. Dietmayer 


external sensor measurements is the yaw rate or yaw angle of other road users. Without 
vehicle-to-vehicle communication, these variables can only be determined reliably for 
one’s own vehicle. 

However, for the subsequent situation evaluation and situation prediction, not only the 
physical measurement of the objects is required, but also information about what class of 
object is involved. For example, a pedestrian and a motorcyclist differ in terms of their 
possible degrees of freedom of movement and also their possible movement dynamic. 
Also, depending on the context and constellation, road surface markings can have dif- 
ferent meanings. Therefore, it is necessary also to determine the semantic meaning of the 
objects detected from the sensor data, or from other information sources such as a digital 
map. In the context of the machine perception, this operation is known as a classification 
step, but it is a component of the machine perception. 

While humans are able to assign a semantic meaning to the visual perceptions very 
quickly and nearly without errors, this is still a comparatively difficult task for the machine 
perception with the current state of the technology. The known classification algorithms 
are always based on more or less complex models of expected object classes, which are 
either learned automatically from examples or are specified manually. These models then 
display, as discriminately as possible, characteristics that can be captured with the 
available sensors, so that a distinction can be made between the object classes that occur. 
However, it also becomes clear that object classes that are not trained in advance cannot 
be identified semantically with the methods known at present. Due to their significantly 
greater capabilities, learning classification algorithms have become widely accepted. 

A machine perception with semantic information is only technically possible in the 
context of driver assistance systems and automated driving because the driving area is 
well structured and limited to a few object classes. Additionally, only a rough class 
differentiation is relevant for situation recognition and situation prediction. With the 
current state of the technology, it is sufficient to be able to distinguish between the 
pedestrian, cyclist, passenger car and truck or bus classes with respect to moving objects. 
Additionally, there are stationary obstacles, but these are usually assigned to a residue 
class along with the non-classifiable objects. 

For the correct assignment of the classified objects to the traffic infrastructure, it is also 
necessary to be able to identify reliably, with the correct semantic meaning, road surface 
markings, blocked areas, stop lines, traffic light systems and traffic signs. As this complex 
classification task is not yet possible with the required degree of reliability, highly accurate 
and comprehensively attributed digital maps are used as a support, based on the state of 
the technology. Knowing its own position, the automated vehicle can use these maps to 
identify the stationary objects and markings expected in the sensors’ field of vision, 
together with their semantic meaning. The sensors then only have to verify that the objects 
are present. 


20 Predicting of Machine Perception for Automated Driving 411 


A disadvantage of this approach is that a highly accurate localization of the vehicle is 
required, for which a standard GPS localization is not sufficient, and the map must always 
be up to date. For this reason, the goal is to develop technical solutions in the future that 
will no longer require highly accurate, up-to-date maps. 


20.2.2 Characteristics of Environment Models 


The machine perception is used to create a dynamic environment model. Two main 
representations are known: object-based and grid-based forms. Both forms of represen- 
tation can also be combined. 

An object-based vehicle environment model is a dynamic data structure in which all the 
relevant object and infrastructure elements in the vicinity of the vehicle are represented 
correctly in space and time. As explained above, the capturing and tracking over time of 
the objects and infrastructure elements is performed continuously by suitable, usually 
fused on-board sensors such as cameras, radars, lidars, and with the additional use of 
highly accurate digital maps. Figure 20.2 shows an example of components that incor- 
porate an environment representation. 

Which objects and structure elements are relevant for automated driving mainly 
depends on the driving task to be performed, the complexity of which increases starkly, 
starting from simple motorway scenarios via country roads to inner-city traffic. In the 
object-based representation, all the other road users relevant to the representation, the 
relevant infrastructure elements and one’s own vehicle itself are described by means of a 
separate dynamic object model, usually a time-discrete state space model. The states of 
this model, such as position, speed or 2D/3D object dimensions, are continuously updated 
in line with the sensor measurements. Furthermore, there is continuous capturing of the 
road surface markings and traffic signs, as well as the status of the traffic light systems. 
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Fig. 20.2 Schematic diagram of the object-based vehicle environment representation. All the 
relevant objects are detected, classified and correctly assigned to the infrastructure. Image rights: 
Author has copyright 
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Fig. 20.3 Schematic diagram of the structure of a grid-based representation of the vehicle’s 
surroundings. In the simplest case, this only contains static obstacles. Image rights: Author has 
copyright 


A grid-based representation uses raster maps to divide the stationary environment into 
localized cells of equal size. The vehicle moves across this localized 2D or 3D grid and 
the on-board, the sensors then only supply information as to whether specific cells are free 
and thus can be driven on freely, or whether there is an obstacle in the respective cell. 
Additionally, the state in which no information on cells is available can also be modeled. 
This type of depiction is mainly suitable for representing static scenarios and static 
obstacles. It does not require any model hypotheses about the object classes to be expected 
and can therefore be categorized as very resistant to model errors. Figure 20.3 shows the 
basic procedure. Further information on grid-based representations can be found in [4—8]. 


20.3 Methods for Dealing with Uncertainties of Machine 
Perception 


20.3.1 Uncertainty Domains 


As described in Sect. 20.2, the machine perception is made up of different task scopes. 
These are, on the one hand, detecting static and dynamic objects and physically measuring 
them as precisely as possible, and on the other, assigning the correct semantic meanings to 
the detected objects. In the context of these tasks, the following three uncertainty domains 
exist for the machine perception: 


1. State uncertainty 
State uncertainty describes the uncertainty in the physical measured variables, such as 
size, position and speed, and is a direct consequence of measuring errors in the sensors 
and sensor signal processing that cannot always be avoided. 
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2. Existence uncertainty 
Existence uncertainty describes the uncertainty as to whether an object detected by the 
sensors and transferred to the representation of the surroundings actually exists at all. 
Errors of this kind can occur due to deficiencies in the signal processing algorithms or 
incorrect measurements by the sensors themselves. 

3. Class uncertainty 
This refers to uncertainty with regard to the correct semantic assignment, which can be 
caused by deficiencies in the classification procedure or insufficiently accurate mea- 
sured data. 


In order to facilitate automated driving, it is necessary to reliably detect any uncer- 
tainties or errors in the various domains and, if possible, even to be able to predict them. In 
the current state of the technology, uncertainties are handled, almost without exception, 
using methods based on Bayes’ theorem [9-11] or on the generalization of same, the 
Dempster-Shafer theory [12]. The advantage of these methods is that they allow the 
uncertainty domains to be handled using a totally probabilistic and therefore mainly 
heuristic-free approach. 

In the narrow sense, the uncertainty domains named above only apply to the on-board 
sensors for now. However, errors in the information from a digital map or in the data 
obtained via Car2x communication can also be categorized. Car2x communication in 
particular can harbor additional sources of error due to possible variable latency times in 
the transfer of data and the possibility of imprecisely known uncertainty evaluations of the 
sending sources. However, the effects can still be assigned to the three uncertainty 
domains named, and therefore we will not go into further detail here. 


20.3.2 State Uncertainty 


The state uncertainty of a detected object is described, in accordance with Bayes’ theorem, 
by means of a probability density function which can be used to determine the most 
probable total and individual state and also, with a certain probability, possible variations 
from this. In the case of a multi-dimensional, normally distributed probability density 
function, the state uncertainty is completely represented by a covariance matrix. 

In estimating static variables, such as the vehicle dimensions, their state uncertainty can 
be reduced progressively by means of repeated measurements. The estimated value based 
on the available measurements converges with the true values, as long as there is no 
systematic sensor error, e.g. in the form of an offset. For the estimation of dynamic, 
time-changeable states such as the object position or the object speed, due to the move- 
ment of the object between the measuring times, there is no convergence with a true value. 
Therefore, for the evaluation of the quality of the state estimation, it is stipulated that the 
mean error is zero and the uncertainty as low as possible. 
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The basic procedure for handling state uncertainties is the general Bayes filter [9]. With 
this, the estimated state of an object and the related uncertainty are represented by a 
multi-dimensional probability density function p (PDF): 


Pr+ (X41 |Zi-k +1): 


In general, it depends on all the measurements Zıx+1 = {z1,..-,2+1} available at 
time k + 1. This is expressed by means of the selected notation of a conditional proba- 
bility, i.e. the probability for the state of system x is conditional upon measurements Z. 

The motion model of an object captured by the sensors for the period between two 
consecutive measurements is described by a motion equation of the form 


Xk+ fk =f (xk) + Ve 


whereby v, represents an additive disturbance variable representing possible model errors. 
The motion equation expresses in which state, such as location, speed and direction of 
motion, the object will probably find itself at the next point in time. Alternatively, this 
motion equation can also be expressed by means of a Markov transition probability 
density: 


Fer ye (X41 |Xx)- 


The Markov transition probability density is ultimately only another mathematical 
notation for the same model assumptions. To keep the equations practically calculable, it 
is common to presuppose a Markov property of the first order. This property expresses 
simplistically that the future state of a system only depends on the last known state and the 
current measurement, not on the entire history of measurements and states. Therefore, the 
Markov property of the first order is a presupposed system property. In our specific case, 
the predicted state x,,; of the object before the new measurement is available only 
depends on the last determined state x,, as this implicitly comprises the entire measure- 
ment history Zik = {z1,...,Zx}. 

The prediction of the current object state x, to the next measuring time k+ 1 is 
basically carried out based on the Chapman-Kolmogorov equation 
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This is denoted as a prediction step of the Bayes filter. 
The measuring process of the sensors can generally be described as a measurement 
equation in the form 


Zepaik = hk+ (Xk+1) + Wes 
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The measurement function h(-) describes how measurements and state variables are 
related. For example, if a state variable can be measured directly, then h(-) is a 1:1 
mapping. Here, the stochastic disturbance variable w; , ı represents a possible measuring 
error. An alternative mathematical representation of the measurement equation is the 
likelihood function 


8 (241% 41). 


If the current measurements zg | are available, the probability density function of the 
object state is updated. The current estimate of the state is calculated using the Bayes 
formula 


g(z+ 1% + 1)Pr 1j (Xk 1 Xx) 
8 (Ze [Xk + 1) Pe + ye (X + 1 la )dx 


Pirita) =F 


This second step to incorporate the current measurement is known as the innovation 
step. 

The recursive estimation procedure briefly described by the prediction step and the 
innovation step is known as the general Bayes filter, and all the methods and imple- 
mentations of the stochastic state estimation commonly used today are based on this. 
Along with the process and measurement equations, the procedure only requires an a 
priori PDF for object state po(xo) at time k = 0. However, it is not efficient to implement 
the filter in this general form. 

With the assumption of normally distributed measurement signals and linear models, the 
Kalman filter [13] enables a simple analytical implementation of the general Bayes filter. 
As a Gaussian distribution is completely described by its first two statistical moments, i.e. 
the mean value and the related covariance matrix, the temporal filtering of these two 
moments represents a mathematically exact solution. The Kalman filter can be applied to 
systems with non-linear process or measurement equations by using the Extended Kalman 
Filter (EKF) [11] or the Unscented Kalman Filter (UKF) [14]. While the EKF linearizes the 
system equations by using a Taylor series approximation, the objective of the UKF is a 
stochastic approximation by using what are known as sigma points [14]. 

Independently of the specific implementation, all the procedures based on the general 
Bayes filter have in common that they continuously supply a probabilistic measure for the 
uncertainty of the physical variables determined from the sensor data. This enables the 
reliable detection of sensor failures, but also of degeneration in the capabilities of indi- 
vidual sensors. For example, if the measured data of individual sensors deviates signifi- 
cantly, i.e. outside the variation range to be expected statistically, there is a corresponding 
reduction in capability. 
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However, it must be remembered that a reduction in the capability of a sensor can only 
be detected after it has occurred. Apart from trend indication in the case of slow 
degeneration, it is not possible to make any prediction of the future perception capability 
in relation to the state uncertainty. 


20.3.3 Existence Uncertainty 


For the performance of automated driving, existence uncertainty is at least as relevant as 
state uncertainty. It expresses the probability that the object in the representation of the 
vehicle’s surroundings actually corresponds to a real object. For example, emergency 
braking of an automated vehicle should only be triggered in the case of a very high 
existence probability for a detected obstacle. 

While the estimation of state uncertainties using Bayes estimation methods is well 
founded in theory, the existence probability in today’s systems is still mostly determined 
on the basis of a heuristic quality measure. An object is taken as confirmed if the quality 
measure exceeds a sensor- and application-dependent threshold. For example, the quality 
measures are based on the number of measurements that have confirmed the object, or 
simply the interval between the initialization of the object and the current point in time. 
Often the state uncertainty of the object (Sect. 20.3.2) is also used for the validation. 

An approach with a better theoretical foundation is the estimation of a probability-based 
existence probability. This firstly requires a definition of the specific object existence. While 
in some applications, all real objects are taken to be existent, the object existence can also be 
limited to the objects that are relevant in the current application. Additionally, a limitation to 
the objects that can also be detected with the current sensor setup is also possible. In contrast 
to a threshold procedure, this determination of the existence probability enables a 
probability-based interpretation option. For example, an existence probability of 90 % 
means that there is a90 % probability that the measurement history and the motion pattern of 
the object were created by a real object. Consequently, the action planning of the automated 
vehicle can use these probabilities when evaluating alternative actions. 

A known algorithm for calculating an existence probability is the Joint Integrated 
Probabilistic Data Association (JIPDA) procedure, also based on the Bayes filter, which 
was first introduced in 2004 by Musicki and Evans [15]. This procedure additionally uses 
the detection and false alarm probabilities of the sensors, which are presumed to be 
known. 

The calculation of the current object existence probability is performed similarly to 
state estimation in the Kalman filter in a prediction step and an innovation step. The 
existence prediction is performed using a Markov model of the first order. The predicted 
existence of an object is given by the Markov chain 


Pr + 1\e(Ax) = pspe (Ax) + pape( Ax) 
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whereby the probability p, represents the persistence probability of the object and pg the 
probability for the occurrence of an object in the sensor capture area. Consequently, the 
probability for the disappearance of an object is given by 1 — ps. In the innovation step, 
the a posteriori existence probability px (4x) is calculated. It essentially depends on the 
number of current measurements that confirm the existence of the object. 

As the persistence probability of an object depends on the current object state and the 
posteriori existence probability in turn depends on the data associations, the JIPDA filter 
can be interpreted as the coupling of two Markov chains shown in Fig. 20.4. The upper 
Markov chain represents the state prediction and innovation known from the Kalman filter, 
while the lower Markov chain represents the prediction and innovation of the existence 
probability. For details on the JIPDA procedure and its specific formulation with regard to 
the applications in automotive applications, see [16] for example. Current multi-object 
tracking procedures only developed in the last few years also enable integrated 
object-specific existence estimation. For further information on this, see [9, 17, 18, 19-21]. 

With regard to the functional behavior of the existence estimation, the same limitations 
apply as with the state estimation. A probabilistic measure for the specific existence of the 
object is continuously supplied. Therefore, sensor failures during operation can also be 
detected reliably in this uncertainty domain. However, a prediction of future capability is 
not possible here either. 
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Fig. 20.4 Structure of a JIPDA filter as coupling of two Markov chains. Image rights: Author has 
copyright 
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20.3.4 Class Uncertainty 


Classification procedures for determining the object class, i.e. the determination of 
semantic information, are structured very sensor-specifically. Due to the significantly 
higher information content, image-based procedures are more common in the classifica- 
tion sector. A differentiation is made for learning procedures in which the classifier trains 
offline using positive and negative examples and then can recognize the trained object 
classes to a greater or lesser extent during online operation. The characteristics used in the 
training are either specified or are implicitly generated themselves in the learning process. 
Methodically, two basic approaches have established themselves in the learning proce- 
dures. On the one hand there are cascaded procedures based on Viola and Jones [22] or 
methods based on different neuronal networks [23, 24]. 

A more classical but also common approach is to specify from the sensor data as many 
deterministic characteristics as possible for the different classes, such as length, width or 
speed, and to determine for these the class-specific statistical variation areas. The mean 
value of the individual characteristics, including the variation range, is approximated by 
means of a normal distribution, for example. Following this, based on the current mea- 
sured values and the known characteristic distributions, the most probable class from a 
Bayesian perspective is determined. If different sensors are to be used in combination 
which can each only capture individual characteristics of the total set, the 
Dempster-Shafer theory [12] can be used for the class determination, because it allows 
“non-knowledge” to be considered as well. However, these procedures are generally less 
powerful than learning procedures, and will presumably continue to diminish in impor- 
tance as a result. 

A disadvantage of all the classification procedures named is that no theoretically 
substantiated probabilities can be determined for the current quality of the classification. 
At present no comprehensive theoretical basis exists for this. The output of the classifiers 
is currently only an individual reliability measure that can be standardized to the value 
range of 0-1. It does not represent a probability in the narrower sense, and therefore 
different algorithms are not comparable in this regard. Image-based trained classifiers 
differ so greatly from characteristic-based procedures comprising lidar and radar sensors 
that standardized treatment of them will not be easy to achieve. 


20.3.5 Summary 


The explanation in the previous sections make clear that the machine perception is made 
up of three fundamental uncertainty domains, namely the state uncertainty, the existence 
uncertainty and the class uncertainty. All domains have a direct influence on the capability 
of the machine perception. If the uncertainties are too great, whereby it must be defined 
which uncertainties are tolerable for specific functions, it is no longer possible to drive an 
automated vehicle reliably. 
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Table 20.1 Uncertainty domains of machine perception and their methodical handling 


Characteristic 


Cause 


Modeling 


Methods 


Prediction of 
the future 


State uncertainty 


Uncertainty in the state 
variables such as object 
position, object speed, 
etc. 

Stochastic measuring 
error of the sensor 
technology used 


Probabilistic; expected 
value with 
variances/covariances 


Closed theory via 
general Bayes filter 
(e.g. Kalman filter 
variant) 


Generally no; limited 
possibility using trend 
indications 


Existence uncertainty 


Uncertainty whether an 
object captured by a 
sensor really exists 


Detection uncertainties 
of individual sensors, 
e.g. camera, lidar or 
radar 


Probabilistic by means 
of detection 
probabilities 

Closed theory coupled 
with estimate of state 
uncertainty (e.g. JIPDA 
filter) 


Generally no 


Class uncertainty 


Uncertainty of class 
membership (e.g. 
passenger car versus 
truck) 


Classification 
uncertainties of the 
algorithms/limitations 
of individual sensors 


No persistent method; at 
present mainly heuristic 


Feature-based: 

Bayes, Dempster-Shafer 
Learning-based: 
Neuronal networks, 
cascaded procedures 
(Viola Jones, etc.) 


Generally no 


What is problematic is that a future higher uncertainty, and thus a greater error 


probability, cannot be predicted in time. While the currently known methods for esti- 
mating state and existence uncertainties do enable a current estimation of the capability of 
the machine perception, in principle it is not possible to predict degeneration in the 
capability of individual sensors or even a failure of components. Only a trend indication is 
possible. Table 20.1 summarizes the results once more. 


20.4 Implications for the Machine Perception Capability 


Prediction 


As was explained and substantiated in the previous sections, the future development of the 
machine perception capability of an automated vehicle cannot be predicted with sufficient 
confidence. By no means can the perception capability for the period of 5—10 s required to 
transfer the driving duties to a human be reliably predicted under all circumstances, as is 
stipulated as a backup option in highly-automated driving. Moreover, a fully-automated 
vehicle would have to be able to achieve an intrinsically safe state autonomously, for 
which even a longer period of time would be required in some cases than for the case of a 
driver taking over. Although there are certainly a number of options for predicting the 
future limitation of the perception capability based on external conditions such as 
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imminent camera glare due to the low position of the sun and sensor limitation due to the 
onset of rain, snow or fog banks, these are special scenarios that also require extremely 
reliable context information. Therefore, in principle, the prediction of the perception 
capability is not a general option for ensuring the necessary reliability for automated 
driving. 

However, as described above, there already exist theoretically substantiated methods 
and procedures for continually monitoring the current machine perception capability and 
being able to detect system failures and the degradation of individual components reliably 
and quickly. Therefore, machine perception systems must be designed in such a way that 
sensor redundancy is provided which ensures that sufficient perception capability remains 
either until the transfer to the driver or, in the case of a fully-automated vehicle, until an 
intrinsically safe state is achieved if individual components break down. Thus, a complete 
failure of the machine perception must not occur. 

Redundancies such as these are basically provided by multi-sensor systems that are 
used in parallel and combine information from various sensors and sensor principles. For 
example, if radar and lidar sensors are incorporated, they both supply distance mea- 
surement data, but of different quality and in a different sensor capture area. The weather 
dependencies of the sensor principles are also different. However, due to the similarity of 
the measured data, they can provide mutual support or also mutual compensation if a 
component breaks down, with a slight loss of measuring quality for the overall system. 
Additionally, only through this usage of independent sensor principles is it possible to 
achieve the highest safety level in accordance with ASIL D, which is required for the 
operational safety in automated driving. 

A redundancy can also be planned and provided easily for cameras. For example, if a 
camera in a stereo camera system breaks down, the second camera of the stereo system 
remains available for the classification tasks and the detection of road markings. Only a 
distance estimate is then no longer available from stereo data and would have to be 
compensated be means of lidar or radar sensors, for example. Of course, a prerequisite for 
this redundancy is that the processing hardware and the underlying software of the 
individual cameras would have to be set up independently, i.e. redundantly. Alternatively, 
an additional mono camera could be incorporated, including its own processing hardware 
and software. Therefore, redundancy concepts such as these can enable a minimum 
perception capability to be always maintained in the automated vehicle, even if individual 
components break down. 

Automated vehicle control is based on the current machine perception and on the 
prediction of the current traffic situation. With the state of the technology, the latter is 
essentially performed by means of a simple prediction of the current motion behavior of 
the objects into the future. Due to the large number of possible and non-predictable events, 
especially the reactive actions of other road users, the uncertainties increase so starkly 
after around 2-3 s that reliable trajectory planning is no longer possible on this basis. 
Therefore, the situation prediction cannot reliably bridge the period for transferring the 
vehicle control back to the driver in highly-automated driving, or for achieving an 
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intrinsically safe state in fully-automated driving, if the machine perception no longer 
continuously updates the vehicle environment model. 

However, due to his/her driving experience, a human is also only capable of anticipating 
the overall situation for around 2-3 s into the future with a degree of reliability [25]. But, 
because a human perceives and interprets his/her environment quasi-continuously, this 
brief prediction horizon is completely sufficient for reacting adequately and de-escalatory 
in practically all situations, and for avoiding accidents as a general rule. This should also be 
possible for automated vehicles, whereby here of course additional latencies and uncer- 
tainties in the perception must be considered. The prerequisite, as mentioned above, is a 
guaranteed minimum capability for the machine perception. 

However, for the overall operation, it is essential that the automated vehicle does not 
put itself into a technically insolvable situation in the first place. The permissible criticality 
of the situation must always correspond to the current machine perception capability. 
What must be considered in particular here are suddenly occurring failures and the 
resulting spontaneous reduction in the machine perception capability. Within the relatively 
reliable prediction period for the situation development of 2-3 s, the automated vehicle 
must be able to adjust its driving behavior to the altered machine perception capability. 
A simple example would be driving on its own lane. If the sensor range is reduced by 
technical failures or weather factors, the vehicle must be able to adjust its speed to the 
current situation within the validity of the prediction, and this represents a reliably 
solvable technical problem. 

While this simple situation is easy to describe and analyze, at present it is generally not 
known how critical situations arise, and what distinguishes these in terms of the capability 
of an automated vehicle. In any case, in establishing the reliability of automated vehicles, 
driving a predefined number of kilometers does not ensure that the resulting dataset 
contains all the possible critical situation developments (episodes). Consequently, it is not 
possible to ensure the operating reliability in this way, regardless of the fact the mileage 
required to statistically prove the very low error rates would be neither practically nor 
economically feasible. 

Therefore, a possible research task in the future would be to find a suitable mathe- 
matical representation of random episodes that would then provide the range of all pos- 
sible episodes. Based on this description, what are known as Monte Carlo simulations, for 
example, can be used to structure the entire episode range into critical and uncritical 
subareas, in order to draw a conclusion about required specific tests. A possible 
methodical approach for this would be rejection sampling, whereby every sample rep- 
resents a complete episode. Starting from basic episodes, which are distinguished by 
different road types (1, 2, or 3 lanes per direction, oncoming traffic), for example, or by the 
number of vehicles in the near vicinity, similar situations are generated through the 
Statistical variation of the episode parameters. When there are a sufficient number of 
samples, it is to be expected that the episode range has been completely covered. In the 
process, every episode used is tested for its physical feasibility, and irrelevant episodes are 
discarded. The remaining episodes are then tested as to whether, for example, critical time 
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gaps or spaces arise between objects. The suitable criteria for this must also be defined. 
The identification and prioritizing of critical situations are carried out by means of sub- 
sequent clustering in the episode range. 

The goal of such a procedure would be to use this hierarchical approach to determine a 
quantity of potentially critical episodes that is as complete as possible but still manage- 
able. This would then be analyzed using simulated data as to its controllability by the 
highly-automated system at different levels of machine perception capability. For exam- 
ple, individual ranges, capture angles and detection rates could be modeled for a sensor 
setup in the vehicle in order to then systematically analyze the consequences for the 
behavior of the vehicle for critical episodes. This analysis can be carried out initially for a 
fully-functioning system, and then under the assumption of a failure of individual 
components. 

Another research question that is open is the possibility of a more reliable situation 
prediction that would use context information and hypotheses about the future behavior of 
the road users to enable longer prediction periods. Such a procedure would be justified to 
the extent that our entire traffic system is based on the cooperation of the road users. Of 
course, a disadvantage of this would be that uncooperative behavior, or simply the errors 
of other road users, could not be expected nor included in the action planning of an 
automated vehicle. In this respect, such approaches do not enable a significant extension 
of the reliably predicted time period, but they can still support planning algorithms. 
Additionally, it should be noted that in many situations manual drivers do not have a 
chance to react appropriately when other drivers do not behave correctly or make 
unforeseen driving errors. Therefore, excessive demands should not be made of automated 
vehicles in this regard. However, naturally this is also a question of society’s consensus 
with respect to the permissible potential risk involved in a new technology. 


20.5 Summary 


The existing methods for the state and existence estimations are based on a closed, 
well-founded theory and enable in-line, reliable evaluation of the current quality of the 
machine perception capability. This makes it possible to detect complete failures of 
individual sensors as well as a gradual degeneration in the sensor technology and/or 
perception. 

However, the procedures do not enable a prediction of the future perception capability, 
and only a linear extrapolation of detected trends is conceivable. The reliability and quality 
of the evaluation of the machine perception capability depends on the available sensor 
models, and error models in particular, which are sensor- and manufacturer-specific. The 
perception systems alone do not have a sufficient prediction capability that could reliably 
cover a time horizon of between 5 and 10 s, as is currently envisaged for returning the 
highly-automated system to the driver. However, this is probably not even necessary for the 
reliable behavior of an automated vehicle. What is decisive for the controllability of 
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situations during automated driving is a sufficient number of physically implementable and 
reliable trajectories for the automated vehicle. These are essentially defined by the spatial 
proximity of limiting objects to one’s vehicle and the available drivable free space. 
Therefore spatial proximity must be incorporated into key figures for evaluating criticality, 
while also taking into account uncertainties in the perception and the number of physically 
possible, reliable trajectories. The currently available machine perception capability must 
also be considered here. Such sufficiently coordinated and theoretically founded criticality 
measures do not exist at present. 

A situation prediction into the future over a period of 2-3 s will not provide a con- 
clusive result in purely model-based, probabilistic extrapolation, as every development of 
the situation becomes possible after this period. A possible approach, and a future research 
question, would be the context-related, hypothesis-based temporal extrapolation based of 
known and evaluated situations stored in a knowledge base. With an existing knowledge 
base, the current situation can then be evaluated continuously with regard to the assumed 
outcome. No reliable methods exist for this at present, and in some cases not even any 
ideas of how it could be implemented. However, this seems to be a path which can be 
taken. 

The advances in situation prediction are extremely difficult to foresee. However, sig- 
nificantly more capable methods can presumably be expected only in a time horizon of 
10 years or more. 
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21.1 Introduction 


In the future, the functions of autonomous driving could fundamentally change all road 
traffic; to do so, it would have to be implemented on a large scale, in series production. In 
general, a technical system such as a car needs to be released for it to make the transition 
from the development phase to mass production [1]. According to the principles of project 
management, production release is only granted when the previously defined requirements 
have been fulfilled by this technical system. These requirements come from a wide range 
of sources, such as customers, standards or legislation. Various areas are addressed by the 
requirements: these include the requirements for the safety of the technical system for type 
approval! and product liability” reasons. 

The safety of people in public road traffic is one of the oft-quoted motivations for 
vehicle automation, because the vast majority of present-day accidents are caused by 
human drivers. Based on this motivation is the requirement that substituting humans does 


‘According to Directive 2007/46/EG [2], the expression “(...) ‘type approval’ describes the 
procedure whereby one Member State certifies that a type of a vehicle (...) satisfies the relevant 
administrative provisions and technical requirements”. 

"Reuter [3] states: “(Tortious) product liability serves to protect any person (product users as well as 
uninvolved third parties) from unsafe products. Product liability regulates the compensation of 
damage to health or property that has been caused by a product defect”. 
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Fig. 21.1 Theoretical potential 
for avoiding accidents with 
vehicle automation [4]. Image 
rights: Gasser 


not reduce the safety of public road traffic. This should apply to both passengers and the 
entire traffic system in which the autonomous vehicle is in motion. What this requirement 
means, and whether it would actually be fulfilled upon the introduction of the autonomous 
vehicle, is the focus of the following discussion. 

A starting point is provided by Gasser et al. [4]: The report from the German Federal 
Highway Research Institute considers the development of accident numbers upon the 
introduction of vehicle automation. Starting from the total number of accidents for con- 
ventional driving (see Fig. 21.1, blue and green field) it is assumed that accidents (green 
field) are avoided by means of vehicle automation. However, new accidents could also be 
caused by the risks of automation (yellow field). 

This representation does not differentiate in terms of the severity of the accident, but 
the severity of the accident is also relevant when considering the impact on safety. Safety 
is generally described as the absence of unreasonable risks. This risk is defined as a 
product of the probability of an accident and the severity of that accident. 

Figure 21.2 illustrates in a qualitative way this theoretical risk avoidance potential 
depending on the severity of the accident. Here Fig. 21.2 adheres to the findings of 
Heinrich [5] and Hyden [6] that accidents of decreasing severity occur in larger numbers. 
The scale of the related severity of the accident is ordinal, meaning that there is clearly an 
order between the different degrees of severity: For example, a fatality is weighted as 
graver than a serious injury. However, academics are divided on the relative weighting of 
these different degrees. While degrees of severity are compared in terms of costs, this is 
contentious and will not be discussed further in this work. 
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Fig. 21.2 Theoretical potential for avoiding accidents with vehicle automation with consideration 
of gravity of accident (similar to [4]). Image rights: Author has copyright 
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Considering the severity and the number of accidents shows that while risks are 
removed (Fig. 21.2 green area), there are risks remaining (Fig. 21.2 blue area) which are 
not addressed by vehicle automation. In addition, new risks are created by the substitution 
of humans and the automated execution of the driving. The human is no longer available 
as a backup in the case of a failure or a defect. The yellow area in Fig. 21.2 illustrates this 
additional risk. It is uncertain here whether the removal of risks and the creation of 
additional risks is uniform across the degrees of severity. It is possible that there is a 
greater reduction in serious accidents but an increase in less serious accidents. Figure 21.2 
illustrates this idea via the deformation of the assumed triangle. 

For the approval of fully-automated driving, this means that not only a reduction in the 
number of accidents must be proven, but rather an accepted ratio V,.. between avoided 
Rayo and additionally caused risks Raaa. 


Contrary to many assertions, it has not yet been proven that a ratio of less than | is 
actually necessary for the approval. Will autonomous vehicles actually increase traffic 
safety? If the ratio were greater than 1, the system would reduce traffic safety. Examples 
exist today whereby corresponding added benefits create acceptance for additional risks: 
For example, for many motorcyclists the experience of freedom, driving pleasure, etc., 
balances out the considerable additional risk compared to other means of transport. In 
addition the apportionment of benefits and risks facilitates the acceptance of motorcycling. 
The added benefits and the additional risk mainly affect the person on the motorcycle. The 
risk for other road users created by a motorcycle lies between the risks created by a bicycle 
and a car, and therefore motorcycling is acceptable without added benefits for other road 
users. 

In this document, no specific value is determined for the acceptable ratio for autono- 
mous driving, because this value is the result of a complex discussion among those who 
would be affected by autonomous driving. This value varies depending on various factors 
such as societal, political and economic differences. A vivid example of this is the 
acceptance of the use of nuclear energy in Germany, the USA or Japan in the last years: 
On the one hand, the accepted ratio varies considerably between the countries, and on the 
other, this changes over time, so that for example in Germany in 2012, a nuclear phase-out 
was decided on. 

The central component of this document is the evaluation of autonomous driving, i.e. 
the study of the methods that are to enable safety assessment of autonomous vehicles. 
Even though a large number of papers describe the potential of autonomous driving in 
theory, the authors are not aware of any document that has conducted this evaluation. In 
order to show why this is so, we will first describe the current release concepts in the 
automobile industry, and then show what the requirements are for test concepts. In the 
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third section, we describe the special features of autonomous driving in relation to current 
systems. On the basis of this, the fourth section looks at the special challenge for the 
production release of autonomous vehicles. The approaches that address this challenge are 
discussed, and then a conclusion on the production release of autonomous vehicles is 
drawn in the final section. 


21.2 Current Test Concepts in the Automobile Industry 


The safety validation concepts currently used in the automobile industry are for obtaining 
approval for four distinct automation levels. To illustrate the difference for the test of these 
systems compared to autonomous driving, these four systems will be explained briefly. 

The first system in series is the driver-only vehicle without the automation of the driving 
task. For these systems, it can be seen that, on the one hand, the components used do not 
exceed maximum failure rates, and on the other, that the driver is able to maneuver the 
vehicle reliably in road traffic (controllability). Here the abilities of the driver are relied on, as 
the results of the conducted tests with test drivers are transferred to future users in the 
subsequent area of use. Over the last decades, this has shown itself to be successful in serving 
as proof of safety. Despite the increasing number of kilometers driven in road traffic, the 
number of accidents remains constant, and the number of fatalities has even fallen. 

The second level of automation in series is the assisting system: For systems such as 
Adaptive Cruise Control (ACC) or Lane Keeping Assist (LKA), their functions have to be 
covered by the test in addition to the existing scope of testing. The option of a take-over 
by the driver and controllability must be provided in systems that actively support the 
driving task, increase comfort, and reduce the burden on the driver. The Code of Practice 
[7] thus assumes that, in this Advanced Driver Assistance System (ADAS), responsibility 
for vehicle behavior remains with the human driver. For these systems it also applies that 
the abilities of the driver are relied on, so that the results of the conducted tests with test 
drivers are transferred to future users in the subsequent area of use. 

The first partly-automated systems have also been approved for use in series cars: 
Depending on the speed, ACC in combination with LKA takes over the lateral and 
longitudinal control for the driver. According to the definition, in the third category of 
systems, the driver is also responsible for the vehicle behavior. Therefore, this test also 
focuses on the possibility for the take-over and the controllability by the driver; and so the 
same principle applies as with the assisting system, which relies on the abilities of the 
vehicle driver to correct undesired automation behavior. This level of automation presents 
the special challenge for the safety validation that results from the conflict between 
relieving the driver and the necessary situation awareness of the supervisor of the lateral 
and longitudinal control. However, here too the driver is ultimately responsible. 

Of particular interest for the test are emergency intervening systems, which automat- 
ically intervene in the vehicle control and thus in the vehicle dynamics. The goal of this 
fourth category of systems is to counter the driver’s loss of control over the situation. For 
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example, Electronic Stability Control (ESC) and Emergency Brake Assist (EBA) are 
components of mechatronic brake systems that apply additional or reduced braking force 
without any action on the part of the driver, thus actively intervening in the vehicle 
dynamics. This is performed during the driver’s loss of control, when the vehicle, in 
combination with the driver, is at a higher level of risk. ESC is designed in such a way that 
an intervention is carried out when the driver clearly no longer has control over the vehicle 
in the current situation (e.g. in the case of extreme over- or understeering). In contrast, the 
EBA becomes active when the reaction time and the braking distance before a rear-end 
collision are no longer sufficient for a human to prevent this accident. The goal of 
validating the system regarding safety requirements is to show that emergency intervening 
systems should only become active (true-positive) when the loss of control becomes 
obvious and thus there is a severely increased risk. For this, it must be shown that the 
false-positive rate becomes as small as possible and/or the effects can be controlled by the 
driver; the false-positive and false-negative rates of the EBA mainly depend on the object 
detection. Figure 21.3 shows a Receiver Operating Characteristic curve (ROC curve), 
which describes this relationship for the object detection. 

As these emergency intervening systems are systems with no guaranteed operation, an 
increase in safety can be achieved by reduced usage combined with a smaller 
false-positive rate. Additionally, these systems enable overriding. ESC and EBA employ 
the selective braking of wheels to intervene mainly in the braking system, and various 
strategies can be used to override them, by steering and/or accelerating. 

As has been shown, the main focus in the development of the four system levels is 
controllability by the driver. The goal is either to enable controllability for the driver or to 
restore it for him/her (design for controllability). Therefore, the driver as a backup is the 
basis for validating current vehicles regarding safety and hence also for the production 
release. 

The development and verification of this controllability for the driver is generally 
carried out in accordance with the procedure model in Fig. 21.4. This procedure based on 
the V-Model differentiates between the downward branch on the left—development and 
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Fig. 21.4 Safety evaluation methods in the development process (according to [9]). Image rights: 
Alexander Weitzel et al. Federal Highway Research Institute report: Absicherungsstrategien fiir 
Fahrerassistenzsysteme mit Umfeldwahrnehmung 


design—and the upward branch on the right— verification and validation—as a means of 
quality assurance. A test concept is followed for the quality assurance. 

As shown by Schuldt et al. [10] in Fig. 21.5, a test concept comprises the analysis of 
the test object (object under test—OUT), the test case generation, the test execution and 
the test evaluation. 

The analysis of the test object and the test case generation should be performed during 
the development/design phase, so that the test cases to be carried out are already defined 
for the verification and validation (see Fig. 21.4 procedure model). According to 
Horstmann [11] and Weitzel [9], at present a distinction is made between three methods 
for the determination of test cases: One method is the test specification based on the 
specification sheet, whereby test cases are defined based on system specifications, which 
have been set down in specification sheets. The second method is the risk-based test 
specification, whereby risk considerations are used to determine the test cases. The third 
method is the interface-based test specification, whereby the test cases are selected in 
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order to cover the value ranges of the interfaces. For all these methods, the driver-vehicle 
system is the basis of the test case determination. 

To start with the quality assurance as early as possible, tests are already carried out in 
virtual test environments before the first test vehicles are ready for testing. The test 
execution by means of model- and software-in-the-loop tests works based on simulation 
models of the vehicle, the human and the environment. The test cases previously identified 
are used here. The further the development progresses, the greater the number of real 
components available for testing. Test benches, driving simulators or testing grounds are 
used in these tests. The tests performed using hardware-in-the-loop, driver-in-the-loop or 
vehicle-in-the-loop provide information about the quality of the components and functions 
being tested. To check the actions and reactions of the driver-vehicle-environment system 
(to close the loop), simulation models are also needed in performing these tests. Therefore, 
simulation models will be required continuously for the test execution up to this devel- 
opment point in order to test the entire vehicle. Simulation models are mappings of reality 
in software and have per se the property of simplifying the real world. 

As a result of this fact, there currently exists no safety-relevant function in a series 
vehicle that has not also been tested with real test vehicles. Thus, for testing current 
systems, the automotive industry always falls back on real vehicles, real humans and a real 
environment. 

A result of the necessary use of real driving is, for example, that before the production 
release of the Mercedes Benz E-Class (W212), a total of 36 million test kilometers were 
completed 2]? According to Fach et al. [13], the safety validation of a current driver 
assistance system alone requires up to 2 million test kilometers. After 50,000 to 
100,000 km were covered in these test drives between two interventions of the first level 
of the EBA, this high number of test kilometers becomes understandable. This does not 
even consider the fact that the more critical second level of the EBA was not triggered 
during these test kilometers (compare assertion in Fig. 21.3). This eight-figure total of test 
kilometers is accompanied by considerable costs for the vehicle prototypes, test drivers, 
test execution and the evaluation of same. While the time requirement can be reduced by 
means of parallel testing with multiple vehicles, additional costs are incurred for the 
vehicle prototypes. 

This example shows that even for current driver assistance systems, validating safety 
based on real driving in road traffic represents an economic challenge for the OEM 
(Original Equipment Manufacturer). This challenge grows further against the background 
of the increasing number of functions and widening ranges of variants and versions for 
each vehicle model. For example, Burgdorf [14], deduces a number of 160 - 27° variants 
for the BMW 318i (E90) with components such as body form, engine, transmission, drive, 
color, A/C, infotainment. 


3«(...) The [E-Class] arrived by way of comprehensive virtual tests with digital prototypes and a 
total of 36 million test kilometers (...).” (Retrieved 28/07/2014). 
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Therefore, there are already endeavors to use other test execution tools alongside real 
driving for final safety validation. The only example of this known to the authors is the 
homologation of ESC systems. According to ECE Regulation 13H for the EU [15], there 
is the option to perform some of these tests in the simulation: 


When a vehicle has been tested physically in accordance with section 4, the compliance of 
other versions or variants of the same vehicle type can be proven by means of computer 
simulations that adhere to the test conditions of section 4 and the test procedures of 
section 5.9. 


Note that this only applies to the ESC system. As an example, Baake et al. [16] 
describe the homologation of ESC systems for vans from Mercedes-Benz in collaboration 
with Bosch and IPG CarMaker: Using what are known as master cars, a vehicle model 
was created in CarMaker, and these master cars were used to collect reference data on the 
basis of which the simulation model was validated. This enabled the simulation-based 
recommendation for the approval of further vehicle variants with different settings. Baake 
et al. also report on the transfer of this procedure to the Cross Wind Assist 
(CWA) function, although this has not yet been done. 


21.3 Requirements for a Test Concept 


In order to discuss in the following section why full automation poses a particular chal- 
lenge for safety validation, we will first describe the requirements for test concepts to 
assess safety. These are divided into effectiveness and efficiency criteria. 


21.3.1 Effectiveness Criteria 


Representative—valid 

The requirement for representativeness has two aspects: On the one hand, the test case 
generation must ensure that the test coverage required is achieved. For example, a vehicle 
should not only be tested at 20 °C and sunshine, as it will be exposed to snow, rain and 
temperatures under 0 °C in real situations. Additionally, vehicle limit samples (tolerances 
during production) should be considered in the test case generation. On the other hand, the 
test execution must encompass the minimum degree of reality required. This means that 
the simplification in the representation of reality must not influence the behavior of the 
OUT nor the behavior and properties of the environment with respect to real behavior. 


Variable 
The test execution must provide the option to implement all the test cases defined by the 
test case generation. 


21 The Release of Autonomous Vehicles 433 


Observable 

For the test evaluation in particular, it is necessary to observe parameters of the test 
execution. Only when the situation can also be described it is possible to make the 
statement test “passed” or “not passed”. 


21.3.2 Efficiency Criteria 


Economical 

There are two parts to the requirement for the economical test concept: On the one hand, 
the test execution should be prepared and carried out as quickly as possible in order to be 
able to provide the persons involved in the development with feedback on the test object 
immediately. On the other hand, it must be ensured that the test execution is prepared and 
carried out at the lowest cost possible. 


Reproducible 

Reproducibility greatly reduces the work required for regression tests. For example, if an 
error has been detected and the test object modified accordingly, the goal is to subject the 
OUT to a test in the same scenario as before. 


In good time 
The earlier in the development process that a product can be tested informatively, the 
fewer the development steps that need to be repeated in the case of an error. 


Safe 

The test execution should not exceed the accepted risk for all participants. This must be 
considered in particular for real driving, whereby road users are participating in the test 
without their knowledge. 

The requirements described are fulfilled sufficiently by the current test concepts, and 
therefore the four different automation levels presented are approved. However, the recalls 
of all the OEMs, which affect millions of vehicles, indicate that these test concepts 
certainly do not address everything. Are these concepts also suitable for validating the 
safety of new systems such as autonomous driving for public road traffic? Nothing 
changes about the requirements presented. However, as will be described in the following 
section, the OUT changes greatly. 
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21.4 Special Features of Autonomous Driving 


In the following section, the difference between fully-automated driving and current 
driving in road traffic is explained. After this, the differences between the traffic systems 
for air travel, rail travel and road traffic are present in compact form, so that only limited 
findings from these areas can be transferred. 


21.4.1 Comparison Between Current Automation and Full 
Automation of Road Vehicles 


For the previously described safety validation of the four levels of automation available in 
series, the focus was on the vehicle, and in particular on its controllability by the driver. In 
the combined representation of the three-level model for human target-oriented behavior 
based on Rasmussen [17] and the three-level hierarchy of the driving task based on 
Donges [18] in Fig. 21.6, this validation corresponds to the elements with the green 
background. The vehicle and its behavior in the longitudinal and lateral directions are 
tested; in the process, the behavior or abilities of the future driver are not tested, but only 
the possibilities for the test driver to control the vehicle in the test cases by means of 
steering and acceleration control. Therefore, the green box only overlaps slightly with the 
area that stands for the driver. 

For full automation, the abilities of the driver are now omitted and he/she also no 
longer functions as a backup. The driving task, i.e. navigation, guidance and 
stabilization/control, is taken over by the driving robot. This means that for autonomous 
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Fig. 21.6 Three-level model for human target-oriented behavior based on Rasmussen and the 


three-level hierarchy of the driving task based on Donges [18]. Image rights: Donges?—to be 
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driving, there is no test of the controllability, but only a test of the operation of a technical 
system. On the one hand, this makes the test easier, because the uncertainties due to the 
human and its individual differences no longer need to be covered by the test. On the other 
hand, there is no longer the option to use test cases and test drivers to draw conclusions 
about other use cases. The human, who generally acts based on skills, rules and knowl- 
edge, is omitted. 

For the safety validation of current systems, safety must be proven that results from the 
driver and the vehicle in combination; however, for the production release of the vehicle, 
at present the focus is solely on the vehicle. Additionally assumed, but not tested, is the 
“reliability” of the driver. In assessing the autonomous system in terms of safety, the 
safety now results exclusively from the technical system of the driving robot and the 
vehicle (yellow field of Fig. 21.6), which must be proven. 

Figure 21.6 shows on the one hand that here the quantity of tasks that must be tested 
increases: The driving robot is required for a wide variety of application areas (see Use 
Cases Chap. 2) such as navigation, guidance, stabilization/control. This task quantity 
presents a particular challenge in public spaces without access limitations. On the other 
hand, the task quality of the technical system changes. Current systems are merely 
executive or are continuously monitored by a human, while for the autonomous system 
the execution of a task must fulfill the requirements of the safety discussed at the 
beginning of this document. 


21.4.2 Comparison of the Stipulations in Air Travel, Road Traffic 
and Rail Travel 


Along with road traffic, there are other traffic systems in which automation has established 
itself. However, the following section will discuss the extent to which the challenges and 
solutions from these areas are transferable to vehicle automation. 

The automation in (civilian) air travel does not currently provide any examples of full 
automation. Even if pilots only very rarely actually perform flying tasks, they are still 
present in a supervising and operating capacity. Table 21.1 provides an overview of the 
differences in the traffic systems, which was taken from Weitzel et al. [9] and Ständer [19]. 
For the safety validation, the safety concept for the traffic flow is of particular interest 
here, as this shows the differences between air travel and road traffic. Air travel operates in 
a legally self-contained traffic space, a collision warning system is mandatory, and 
external monitoring of operations is provided by air traffic control. 

The railway traffic system provides examples of full automation: For example, an 
automated underground railway is in operation in Nuremberg. However, according to 
Table 21.1, even in this traffic system the safety concept for the traffic flow in particular 
differentiates between road traffic and the railway. There is a legally self-contained traffic 
space for rail travel; in addition, logic-based systems and external monitoring are used to 
avoid a collision between two trains. 
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Table 21.1 Comparison of the conditions in the traffic systems, taken from Weitzel et al. [9] and 


based on Stander [19] 


Air travel 
Movement 3-D (space) 
options 
Operator 
Responsible Usually redundant 


vehicle operator 


Professionalism Almost completely 
full-time occupation 


of the vehicle 


operator 

Training 

Theory > 750 h 
Practice > 1500 h 
Training for Yes 


vehicle type 

Further training Required 
Safety concepts of the traffic flow 
Legally defined 
boundaries 


Traffic space 
self-contained 


Driving by sight No, only in special cases 


Technical Collision warning 

equipment systems mandatory 

(examples) 

External Yes, air traffic control 

monitoring 

Technical framework 

Documentation Yes 

of 

tours/operating 

hours 

Servicing, Only by certified 

repairs companies 

Accident Every accident/serious 

analysis malfunction, by 
independent state-run 
body 

Number of 10° (decreasing) 

vehicles (in 

Europe) 

Change of Approx. 20 years 

model 


Road traffic 
2-D (area) 


Not redundant 


Small 
proportion 
full-time 
occupation 


S Ail In 
>9h 
No 


Not required 


In special 
cases 

Yes 

Road 
markings, 
traffic lights, 
traffic signs 
No 


Workshops, 
DIY 

In individual 
cases, by 
certified 
assessor 

10° 
(increasing) 


Approx. 
5-7 years 


Rail travel 
1-D (line) 


Not redundant 


Almost completely full-time 
occupation 


~ 800h 
~ 400 h 
Yes 


Required 


Legally defined boundaries 


No, only in special cases 


Automatic vigilance device, 
intermittent train control, automatic 
driving and braking controls 


Yes, centralized traffic control, 
operation center 


Monitoring of operating 
performance, automatic tachograph 


Only by certified companies, and 
then also small workshops 


Every accident/serious 


malfunction, by independent 
state-run body 


10° (decreasing, with increasing 
kilometric performance of each 
traction unit) 


Approx. 20 years for traction units 
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As a mixed operation, road traffic does not fulfill the condition of a self-contained 
traffic space and external monitoring. The differences show why solutions for the pro- 
duction release cannot be transferred directly to autonomous driving. 

This comparison should not exclude the possibility that all solutions from air travel and 
rail travel are of no interest for road traffic. Certainly similar problems exist, such as the 
reliability of safety-relevant components. 


21.5 The Challenge of Releasing Fully-Automated Vehicles 
for Production (the “Approval-Trap”) 


As has been shown, the functions of autonomous driving as an OUT differ fundamentally 
from current road vehicles, but also from means of transportation in air and rail travel. 
Therefore, we now want to determine how meaningful the current test concepts presented 
would be when transferred onto autonomous driving. We will also discuss what the effects 
would be of continuing with the current test concept. 


21.5.1 Validity of the Current Test Concept 
for Autonomous Driving 


It has already been explained that a test concept consists of test case generation and test 
execution. Now we want to discuss how and whether both are transferable to autonomous 
driving. 


Test case generation 

The three procedures for test case generation have already been explained briefly in 
Sect. 21.2; these procedures are based on the assumption of the driver’s driving capability. 
The question of whether a random driver can control the test object is tied to the legally 
stipulated driver’s license. According to the Road Traffic Act (§ 2 Abs. 2 StVG), this 
driver’s license is only issued if, among other things: 


— the applicant has attained a minimum age, 

— he/she is suitable for driving a motor vehicle, 
— he/she has received training, 

— and has passed theoretical and practical tests. 


And according to § 2 Abs. 4 StVG, suitable is taken to mean: 


A person is suitable for driving motor vehicles if he/she fulfills the necessary physical and 
mental requirements and has not substantially or repeatedly contravened traffic regulations or 
criminal laws. 


On the basis of this required driving capability on the part of the driver, the test case 
generation is limited to example situations: It is assumed that when the test driver has 
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mastered these example situations, he/she and every other driver with a driver’s license 
will also master the other relevant non-tested situations when driving. These include 
situations in which the driver is actively driving, but also those situations in which the 
driver is supervising the system and, if necessary, takes over control. Therefore, in 
combination with the driver’s license test, these test cases provide a metric that allows a 
conclusion to be drawn about the safety of the driver-vehicle system. The way in which it 
would be possible to optimize the practical driver’s license test as an evaluation basis for 
assessing the driving capability is discussed by Bahr [20]. 

In the absence of the driver, the currently accepted metric no longer applies, and 
therefore the reduction of the test cases is no longer admissible. The test case generation 
for autonomous driving must cover the driving capabilities in particular—a new quality of 
functions—which the human previously brought to the driver-vehicle system. The theo- 
retical and practical tests of the driver’s license test do not represent the difficulty here. 
However, the following paragraphs—§ 10 Minimum Age, § 11 Suitability and § 12 
Visual Faculty of the Driver’s License Regulation—present the challenge. Therefore, 
these paragraphs stand implicitly for comprehensive requirements for the properties of the 
humans who perform driving tasks. The human who fulfills these requirements has 


— experienced hundreds of thousands of kilometers as a road user, 
— experienced social behavior as a member of society, 

— learned cognitive abilities, 

— trained sensomotor abilities, 

— etc. 


The authors are not currently aware of any method for validly testing these functions 
for a technical system. Therefore, the accepted metric and the reduction of the test cases 
no longer apply if the human is removed from the responsibility of performing the driving 
task. The current test cases are not meaningful for releasing automated vehicles for 
production, and therefore the test case generation must be adapted to the new system. 


Test execution 

As has already been shown, different methods ranging from HiL to SiL to real driving are 
used for the test execution. At present, real driving is the most important method for the 
approval; the reason for this, in particular, is the validity combined with the justifiable 
economic overhead. However, along with the economic overhead, autonomous driving 
also presents a systematic challenge for the known methods. At present, real driving 
stands for driving in public road traffic with test drivers. The task of the test driver is to 
drive or supervise the vehicle in every situation in accordance with the task of the vehicle 
user. Transferred to autonomous driving, the use of a test driver in the driver’s seat would 
be non-real behavior of a user, as the user does not have to supervise the vehicle and the 
environment anymore and intervene. Additionally, the vehicle could also participate in the 
road traffic without passengers (depending on the use case), and therefore a test driver 
would represent a non-real component in the vehicle. As a result, there is a risk that the 
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use of a test driver could influence the other road users and alter their behavior. Further 
reflections on this topic can be found in the Chap. 7. 

Therefore, along with the test case generation, the current test execution is not directly 
transferable to autonomous driving. 


21.5.2 Millions of Kilometers on Public Roads Until the Production 
Release of Fully-Automated Vehicles 


The following theoretical consideration will show what it means to retain the current test 
concept despite the differences shown. Let us assume that a reduction in the test cases is 
not possible for autonomous driving, because no method exists, as with the driver’s 
license test for humans. The objective is still to draw a conclusion as to whether the risk is 
increased or not by the use of the autonomous vehicle: 


Here we should note once again that this condition is in no way imperative. However, 
for the theoretical consideration, a condition of less than 1 is assumed to be the worst case 
scenario. 

The only metric that the authors are aware of that can be used to determine such a 
relationship are the figures from the subsequent evaluation of traffic accidents. For Ger- 
many, these are the figures from the Federal Statistical Office. For example, for 2012 the 
Federal Statistical Office [21] cites 3375 fatal accidents recorded by the police in Ger- 
many. The figure for fatalities is used because this represents the worst case scenario for 
the verification required. With a total of 709 billion km driven in Germany, this figure 
represents an average of 210 million km between two fatal accidents. As these figures only 
represent an expected value, shorter or longer distances also exist between two accidents. 
To represent this distribution of the accident events, we use the Poisson distribution: 


A _, 
P;(k) = Pr 
Here it is assumed that the occurrence of an accident is an independent and 
non-exhaustive random process P;(k). In the equation, k corresponds to the number of 
accident events and / to the expected value with which this event occurs. The expected 
value A is defined by the quotient 
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Fig. 21.7 Poisson probability 1 T T T I I - 
distribution for the number of : : i [4 = 1 autonomous 
accidents with different neha: —_— TANE: and EE = 2 driver only | 


expected values. Image rights: 
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whereby sıesı stands for the observed test kilometers and sjeisı for the performance of the 
system. The performance stands for the expected number of kilometers between the 
accidents. The probability distributions for k = [12345] and 4=[12] are shown in 
Fig. 21.7 as an example. 

The figure clearly illustrates the problem of providing verification of a certain level of 
risk: Let us assume that the blue distribution stands for an autonomous vehicle and the red 
distribution for a driver-only vehicle. Both vehicles are driven the same number of test 
kilometers Stes: = as - S, with the distance factor a, = 2 and the average interval s between 
two fatal accidents. The performance Sperf = Aperf - $ Of the autonomous vehicle is greater 
than that of the driver-only vehicle by the performance factor apert = 2. Consequently, for 
the autonomous vehicle 4 = 1, and for the driver-only vehicle 2 = 2. 

Even though the autonomous vehicle is characterized by double the performance of the 
driver-only vehicle according to the previous assumption, during the test the autonomous 
vehicle was involved in a fatal accident (probability P;(1) = 1 - e7! ~ 0,37), but not the 
driver-only vehicle (probability P2(0) = 1 - e~? ~ 0, 14). Therefore, a conclusion that the 
autonomous vehicle is less safe than the driver-only vehicle must be called into question. 
In any case, this example shows that a distance factor a, greater than 2 is necessary to be 
able to draw a conclusion with a sufficiently high significance about the performance of 
autonomous driving. 

From a scientific point of view, for example, an error probability of 5 % must be 
assumed, and therefore the same significance level e = 5% must be used. A corre- 
spondingly large distance factor a, must be selected, depending on the number of acci- 
dents, in order to have a probability of less than 5 % for a vehicle with a lower 
performance to achieve this low number of accidents. Figure 21.8 shows the result of this 
consideration and the numeric calculation of the values. 
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Fig. 21.8 Distance factor at 
significance level 5 %. Image 
rights: Author has copyright 
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The data point at zero fatal accidents means that, with a distance factor of a, ~ 3, the 
probability is less than 5 % that a worse vehicle than the comparison group is not involved 
in a fatal accident. 

Unfortunately, the probability of success for this test is just as small. Because if the test 
vehicle is just as good as the comparison group, i.e. performance factor Aperr = 1 applies, 
it follows that the probability of success for this verification is also only 5 %. For the test 
to be successful, a greater probability of success is desirable. As an example, a probability 
of success of 50 % is now demanded; by which a test shows that the test vehicle is not 
worse than the comparison group. For this, the test vehicle must perform better than the 
test group. Figure 21.9 shows the result of this consideration. 

The first point expresses the following: If the test vehicle is approx. 4.3 times better 
than the comparison group, the test is successful with a probability of 50 % that the test 
vehicle with an error probability of 5 % is better than the comparison group. 


Fig. 21.9 Distance factor over 
performance factor at a signif- 
icance level of 5 % and a 
probability of success for the 
test of 50 %. Image rights: 
Author has copyright 
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What this result now means for the test drive with the autonomous vehicle is 
demonstrated by the distance of 210 million km between two fatal accidents. The last 
point in Fig. 21.9 expresses the following: If the autonomous vehicle is approx. twice as 
good (dpe 7 2) as the comparison system (current vehicles), a test distance of at least 
2.1 billion km must be driven (Stes, = a, : 210 Mio km). In this case, the verification has 
been achieved with 50 % probability, but five accidents would also occur with the same 
probability. 

Ironically, it follows from this consideration that the easier the vehicle driving is, the 
greater the number of test kilometers that must be driven, as the comparison value is 
correspondingly higher. For the interstate pilot, the current figures of the Federal Statis- 
tical Office indicate a comparison value of 662 million km between two fatal accidents. 
Accordingly, 6.62 billion test kilometers must be driven on the interstate in order to 
correspond to the presented conditions. 

This theoretical excursion into statistics shows that production release can become a 
challenge, if not an actual trap, for autonomous driving. Hereby, a number of factors for 
determining the test kilometers have not been addressed yet; for example, a variation of 
the system would mean that the test kilometers would have to be driven again, or the test 
with and without passengers could use a factor of two in the calculation. The effect on the 
determined necessary kilometers of different parameters not considered here such as area 
of use, accident severity, accident cause and comparison vehicle, is derived in detail in 
Winner [22]. 

These considerations are theoretical observations with freely made assumptions. 
However, this approach is still suitable for illustrating the problems and challenges, and 
for motivating the approaches that follow here. 


21.6 Possible Approaches for Solving the Challenge of Testing 


As has been shown, autonomous driving represents a new OUT which, due to its prop- 
erties, calls the classic test concepts into question. New approaches are required to 
overcome the testing challenge described: Accordingly, the next section will discuss why 
reusing approved functions, and thus an evolutionary approach, seems necessary from the 
perspective of safety validation. After this, we will discuss existing approaches that could 
speed up testing. 


21.6.1 Reusing Approved Functions 


The first and simplest possibility of obtaining the production release for a new system is in 
reusing functions already released. If a system is used in the same way as before, a release 
already issued can be taken over. However, if the scope of functions is expanded, this 
must be treated again; the smaller the new area involved is, the less work is required. 
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Based on this argument, an evolution across all dimensions would seem to be a 
possible approach for overcoming the testing challenge. Dimensions here refers, for 
example, to the speed, the area of use but also the degree of automation. A distinction can 
be made between two perspectives in selecting the evolution steps: From the perspective 
of a function developer, due to the reduced speed and the limited access to the scene, the 
interstate during a traffic jam is a suitable starting scenario. From the perspective of the 
previously presented statistical considerations, a meaningful starting scenario would be 
one in which the human as a comparison group would perform as badly as possible, i.e. 
making as many errors as possible. As many errors as possible means a short distance, 
making the verification of the performance easier. 

The revolutionary step—an autonomous vehicle without evolutionary intermediate 
steps—contradicts this approach and seems unlikely. 


21.6.2 Speeding up the Testing 


Despite the evolutionary approach, the safety of new functions still has to be validated. To 
speed this up, there are basically two adjustments that can be made: Firstly, the What can be 
changed, and secondly the How. What test cases need to be inspected, and how will these 
tests be performed? Schuldt et al. [10] call this the test case generation and the test execution. 


21.6.2.1 Test Case Generation 

The test case generation defines the tests to be carried out. According to Schuldt et al. 
[10], the large number of influencing factors in the area of use and their value ranges result 
in a conspicuous number of test cases. As already described, the systems currently in use 
are based on the capability of humans and their options for controlling the vehicle. This 
results in a stark reduction in the test cases theoretically required. Therefore, a metric 
exists that enables a conclusion about the safety without testing all the situations. This 
reduction does not apply for the autonomous vehicle, and therefore new ways must be 
found of reducing the number of test cases for the autonomous vehicle. During the test 
case generation, the requirements for a test concept detailed in Sect. 21.3 must be con- 
sidered. In particular, the representativeness is at risk when test cases are omitted. 

Here the approaches from Glauner [23] and Eckstein [24] describe the identification of 
relevant or critical situations in public road traffic. Based on previously defined event 
classes, potential critical situations are identified during the test drives or large-scale field 
studies. These critical situations are incorporated into the test case generation, and less 
critical situations can be omitted as a result. This reduction is based on the assumption that 
situations that are less critical are covered by critical situations. A task that remains 
unsolved at present is the search for a valid measure of risk that enables an evaluation in 
the first step, and the selection of critical situations in the second step. 

Another procedure for reducing test cases is provided by Schuldt et al. [10]: A generic 
test case generation is proposed to cover factors influencing the safety ensured by the 
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system as sufficiently as possible. This should use black-box testing procedures and 
combinatorics, and also be low-redundancy and efficient. This approach is based on 
statistical considerations without knowledge and experience of the test object, but it still 
has the potential to reduce the test cases required. 

The approach described by Tatar and Mauss [25] is also suitable for black-box testing: 
an optimization is used for the generation of test cases. Here the input variables of a XiL 
simulation are varied in such a way that the evaluation function to be defined for the test is 
optimized. Despite the challenge of the valid XiL simulation and the required evaluation 
function, this approach provides the option to focus the test cases on those evaluated as 
relevant. 

A fourth theoretical approach is to use and test a safety concept using formal methods 
[26]. Similarly to the human assumed to be a monitor and a part of the safety concept of 
current vehicles, a verified reliable safety concept could make testing the overall func- 
tionality of the vehicle in its complete representativeness superfluous. This would make a 
reduction of the test cases possible. 


21.6.2.2 Test Execution/Test Tool 

Along with the possibility of reducing the test cases during the test case generation, the 
test execution also has potential for speeding up the process. However, if we deviate from 
real driving and select another testing tool for the test execution, there is always an 
attendant simplification. This is described in more detail by means of Fig. 21.10. 

Figure 21.10 divides the testing tools into nine classes which are differentiated based 
on how the vehicle and the environment are represented. The passenger is assigned to the 
vehicle in this representation, as he/she is situated in the vehicle and does not actively 
intervene in the autonomous driving. 

Real driving represents both the environment and the vehicle in reality. Accordingly, 
during these tests there is the risk of real accidents and their consequences. The envi- 
ronment is not controlled, and this results in test situations based on the randomness of 
reality; accordingly, the reproducibility for complex situations with other road users is not 
a given. This testing tool can be used, at the earliest, with the first roadworthy prototypes, 
and therefore occurs at the end of the development process. 


Environment 
virtual | artificial real 
é i iji “A . 
virtual ee aL > = valid 
9 II, 
2) ! NA . 
= artificial v t XS economical 
v 
> 
l E real 
iss + driving 


Fig. 21.10 Classification of testing tools for testing autonomous vehicles. Image rights: Author has 
copyright 
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An alternative is to test real vehicles in an artificial environment: This corresponds to 
driving on a test ground, as there situations are created artificially on the one hand, and on 
the other the “road users” are conscious of being involved in a test. Reality is simplified 
for the benefit of safety, variability, observability and reproducibility. From economic 
perspectives, while the test cases are tested specifically and do not have to be experienced 
randomly as in real driving, setting up the test field requires additional time and financial 
resources. 

Additionally, an artificial vehicle could move within a real environment; in this case, 
artificial refers to equipping the autonomous vehicle with a supervisor, for example, that 
has the option to intervene in the driving task. This could be a test driver with a steering 
wheel and pedals, or alternatively a technical system that is superior to the series system 
due to its more powerful (additional) sensors. If components are represented artificially, 
the closeness to reality suffers, but gains are made in terms of safety, reproducibility and 
observability. 

Along with the option of creating the environment and the vehicle artificially, there are 
tools that use a virtual representation in the form of computer simulations. Here the two 
fields that combine the real and the virtual have a gray background, because strictly 
speaking they do not exist, because the task of sensors and actuators is to switch between 
virtual and real signals. A real radar sensor cannot sense a virtual environment, and a 
virtual converter cannot create real voltage. 

However, what are possible are combinations of artificial and virtual environments and 
vehicles. Examples of this are provided by different concepts of vehicle-in-the-loop (ViL). 
To close the loop made up of actions and reactions of the environment and the vehicle, 
real components are mapped in the simulation in the form of models. Here either the 
sensors or actuators mentioned are stimulated, i.e. artificially instigated (examples of this 
are simulation-based videos as stimulation for camera systems or dynamometers as 
stimulation for drive actuators), or the testing tools directly simulate the power signals, 
such as the electromagnetic wave, and try to represent real effects of sensors and actuators 
in the simulation with the aid of models. For more information on this, see Bock [27] or 
Hendricks [28]. The use of models described calls the meaningfulness of these testing 
tools into question. To get valid results using such models, it must be verified that these 
models do not contain any impermissible simplifications; here impermissible is to be seen 
in the context of the function, and means that deviations from reality are only permissible 
below the tolerances of the function. However, if this validity has been verified, the testing 
tool enables greater safety during the test execution, as parts of the environment and the 
vehicle only encounter each other in the virtual world. Due to the virtual components, 
these testing tools are distinguished by greater variability, observability and repro- 
ducibility. From an economic perspective, this testing tool has the advantage of varying 
the virtual environment easily or representing the vehicle in a wide range of variants. An 
economic disadvantage could be the validation of the models (see below). An advantage 
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of this testing tool is the option, based on the simulated vehicle, of performing tests early 
on during the development. 

The last level of abstraction represents the combination of a virtual vehicle and the 
virtual environment: The software-in-the-loop testing tool represents the closed control 
loop by modeling relevant components in the simulation. In contrast to the previous 
testing tools, the entire testing world is virtual. The tests are safe, variable, observable and 
reproducible; there is also the option of using this tool early on during the development. 
The economic advantage is provided by the hardware independence, as there is no con- 
nection to real time any more. The execution of the tests is only limited by the computer 
power; simulations can be run day and night, and also parallel on a large scale. On the 
other hand, there is the necessary closeness to reality of the virtual test world, and 
therefore of every individual model: Only when the validity of the models used can be 
verified are virtual tests sufficiently conclusive for a production release. Accordingly, for 
the economic consideration of simulation-based procedures, the validation of the models 
must be considered above all. 

The same challenge exists for the use of formal methods. Mitsch [26] writes in this 
context: “We do (...) prove that collisions can never occur (as long as the robot system fits 
to the model).” This means that even for formal methods, the degree of reality of the 
models used determines the conclusiveness of the results. For example, a particular 
challenge that is therefore a focus of the research is the formalization of the uncertainties 
of sensors or the property of other road users. 

The discussion relating to testing tools shows the potential to speed up the testing. With 
the aid of the artificially created environment and vehicle, test cases can be set up and 
executed specifically. Additionally, the virtual approach enables the tests to be speeded up 
and run in parallel, depending on the computer power used. 

However, the discussion also shows that the validity of the tests, and therefore their 
conclusiveness, presents a challenge when artificial and virtual components are 
introduced. 


21.7 Conclusion 


Autonomous driving is distinguished in particular by the omission of the human super- 
visor of assisted or partially-automated systems, and the supervisor’s ability to correct 
these systems. The metric consisting of real driving and driver’s license test that enables a 
conclusion about the safety of automation levels currently present in series production, is 
no longer valid for autonomous driving. The resulting loss of the reduction in the test 
cases means that current test concepts are not suitable for economically assessing the 
safety of a new system such as autonomous driving. Adhering to current test concepts 
would involve an economically unjustifiable overhead, and would result in an 
“approval-trap” for autonomous driving. However, the authors see three approaches for 
avoiding this “approval-trap”. 
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Firstly, the evolutionary approach, or alternatively the transformation (see Chap. 10), 
seems necessary, as only the step-by-step introduction along the different dimensions of 
speed, scenery and degree of automation enables existing components to be taken over 
and reduces the range of tasks for the following releases. Secondly, the necessary test 
cases must be reduced based on field experience and statistical procedures. The challenge 
here is the metric that allows a conclusion to be drawn about the safety of the system 
based on the completed test cases. Thirdly, alternative testing tools must be used alongside 
real driving. Here it is not expected to be able to do without real driving completely, 
because a verification of validity is required to move test cases to ViL, SiL and procedures 
that formally prove safety. 

Finally, it must be stated that the challenges presented should not only be solved 
internally by the automobile industry. Even if test concepts are optimized for autonomous 
driving, there will not be 100 % safety. Vision Zero remains a vision for now, particularly 
in mixed operation with additional road users. With the first accident caused by an 
autonomous vehicle, at the latest, the previously issued release will be put to the test. 
Accordingly, the basis for the production release should be discussed publicly by all 
concerned and be designed transparently. 
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Walther Wachenfeld and Hermann Winner 


22.1 Introduction 


With autonomous driving, a technological system will replace humans in driving auto- 
mobiles. The car industry, universities, and large IT companies, are currently working on 
implementing functions permitting a technological system to take on vehicle operation. 
Their focus is on the tasks that are also done by humans: of perception, cognition, deciding 
how to act (planning) and carrying out this behavior (acting). In addition, humans possess 
further capabilities not directly connected to driving a vehicle. For example, learning 
directly changes people’s capacity to tackle tasks. In the driver-vehicle-environment sys- 
tem, this human capability raises a question: Will the technological system that is to replace 
humans also exhibit a capacity to learn? In the most diverse fields, primarily IT-driven 
ones, there are learning and learned systems of the most varied kinds, which rival con- 
ventional analytical systems in their performance. What marks out vehicle automation, 
though, is firstly its relevance to safety; secondly, how cars as a product additionally differ 
from other IT-industry goods in their system life cycles. Both of these particularities, with 
their challenges and attempts at solutions, are the subject of this chapter. Attention is also 
given to collective learning in the context of autonomous driving, as directly exchanging 
with and copying from the learned is one of the particular advantages machine learning has 
over the human version. 

Replicating human learning in machine learning occupies a whole area of research. It is 
expected that examining the processes of human learning will both provide a deeper 
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understanding of this process and improve applied machine-learning methods. With ref- 
erence to the currently understood difference between both forms of learning, machine 
learning is understood in this chapter as an algorithm generated by a human. The running 
of the software follows these algorithms, just as with all other software. Our objective is 
not to compare a learning human with a learning robot. Rather, it is to discuss why, 
whether, and with which challenges and approaches machine learning is possible in its 
current form in autonomous driving. This chapter portrays the view of vehicle technology 
in particular on this question, and is based on experience from the literature for the area of 
machine learning. 


22.2 Vehicle, Environment and Learning Drivers 


When a driver drives a vehicle in any environment, it constitutes target-oriented behavior. 
According to Rasmussen [1, 2], people display behavior here that can be divided into 
three areas. They behave according to their skills, rules, and knowledge (see Fig. 21.6 in 
Chap. 21). Skill-based behavior is described by Rasmussen [1] as stimulus-response 
automatism, which people overcome in routine everyday situations without placing 
intensive demands on cognitive capacities. 

Rule-based behavior proves to be more cognitively demanding. It requires associative 
classification in addition to perception and motor actions. People in this case match the 
recognized situation to a known rule and, based on this, select from a repertoire of 
behavioral rules. People have learned these rules purposely, or noticed (“saved”) them in 
past situations and behavior. This gives people the ability to identify similar situations and 
transfer learned rules to them. 

Should situations arise that are new for people, and for which they have no trained 
behavior, then their response will be knowledge-based. People try, based on their trained 
knowledge, to generate and evaluate the alternative ways to act that are available to them. 
The subjectively optimal alternative is selected and carried out. 

Rasmussen’s [1] understanding of target-oriented behavior makes clear what is meant 
by a learning driver. At the beginning of their “career,” a driver builds up their basic 
knowledge of road traffic in theory courses at driving school. This is then tested. In the 
process, this knowledge builds on what has already been learned by living in society. In 
addition, rule-based behavior is trained via theory and practice lessons. Upon obtaining 
their driver’s license, people can then drive on public roads without further supervision 
(exception: driving when accompanied with a license at 17 in Germany). However, 
drivers at this point in time have neither learned all the rules nor processed the knowledge 
needed for their future lives on the road. With each new piece of experience they gain, 
their behavior transforms from knowledge-based to rule-based, and from rule-based to 
skill-based. Training thus enables an increase in efficiency in human behavior [1]. 

If we consult the figures for car drivers involved in accidents per million passenger 
kilometers, then according to Oswald and Williams [3, 4] the risk falls with increasing 


22 Do Autonomous Vehicles Learn? 453 


human age, until it starts to rise again from 40 to 50. According to Burgard [5], experience 
gained with age is responsible for this, alongside character skills (personality) and mental 
and physical prerequisites. If we view the assimilation of experience as a learning process, 
then the capacity to learn contributes to improved driving skills [6]. 

If road traffic followed clear and known rules, people would not need to behave in the 
ways described above. Road traffic, however, is an open system consisting of static and 
dynamic objects, and a multitude of environmental factors such as light levels and rain. 
Even if only to a limited extent compared to beginner drivers, experienced road users 
continue to come across unknown situations that need dealing with. It is because people 
show just this knowledge-, rule- and skill-based behavior that today’s road, with its 
efficiency, accuracy, and safety, is possible. 

Further, this behavior leads to individually varied driving behavior. In one and the 
same situation, drivers act differently and have different preferences in selecting distances, 
speeds and acceleration. 

It is precisely these capabilities enabled by skill-, rule-, and knowledge-based behavior 
that will be taken out of driving upon automation, and replaced with corresponding 
capabilities in driving robots. 


22.3 Learning Technical Systems 


The term machine learning stands for a research area dealing with methods for designing 
algorithms. A particular feature of these algorithms is the automatic improvement of 
technical systems based on experience. In this, the automatic improvement follows rules 
and measures previously defined by the human developer. The hotly debated ideas of 
completely free and creatively acting machines, were they to exist at all, are not our focus 
here. In employing machine learning, a clearly defined task is needed, with accompanying 
assessment metrics and (training) data. 
An oft-used quote for the definition of machine learning is from Mitchell [7]: 


A computer program is said to learn from experience E with respect to some class of tasks T 
and performance measure P, if its performance at tasks in T, as measured by P, improves with 
experience E. 


According to Mitchell [7], machine learning has proved itself in service particularly in 
the following circumstances: 


(a) There is a large quantity of data in a database that, by implication, potentially 
contains valuable information that can be extracted automatically. 

(b) People only have limited understanding of a certain area and thus lack the knowledge 
for effective algorithms. 

(c) In tasks demanding dynamic adjustment to changing conditions. 
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How these definitions and their usage areas fit to autonomous driving is discussed in 
Sect. 22.4. First, however, we shall take a look at the processes of machine learning. With 
the aid of examples from various fields, we will explore the range of usage possibilities 
before examining the task of autonomous driving in particular. 


22.3.1 Overview of the Various Machine-Learning Processes 


Breiman [8] noted the following in 2001: 


In the past fifteen years, the growth in algorithmic modeling applications and methodology 
has been rapid. It has occurred largely outside statistics in a new community — often called 
machine learning. 


In [9], the first machine-learning operations are traced back to McCulloch and Pitts in 
1948, among others. The multiplicity of learning processes thus makes a detailed 
description of all of them impossible. Therefore, the following will describe categories of 
learning problems into which we may at least group the processes [10-12]. 


Supervised learning 
Supervised learning, or learning with a teacher, is characterized by pre-assessed training 
data (labeled data). This training data—the experience that machine learning builds on— 
contains the input and output parameters of a learning problem. In the classification of 
whether airbags are deployed in an accident or not, for example, training data would 
consist of acceleration values and the corresponding assessments (deploy or not). These 
assessments must be made by an expert/teacher, for example, or by observation over time. 
The learning process then uses these empirical values to determine the output for newly 
observed input values. In the transfer of empirical values onto new input values, we can 
distinguish [10] between lazy (memory-based) learning and eager (model-based) learning. 
In lazy learning, the training data are saved during the learning and a similarity measure 
is defined. This similarity measure can vary in its complexity, and ranges from the simple 
Euclidian distance to complex distances in case-based reasoning. When output values are 
sought for new input values, the most similar training data to the new case are determined 
and output values derived from them. This procedure corresponds to transductive infer- 
ence [13]. In eager learning, in contrast, a global model based on training data is con- 
structed during the training phase (induction). Output values for new cases are obtained by 
deduction from the model. 


Unsupervised learning 

For unsupervised learning, or learning without a teacher, training data are also on hand, 
although in this case with no assessment or output values (unlabeled data). In this learning 
process, the aim is to find a structure in the data, and classify the data according to the 
structure. The training data are here used to reveal these structures and, based on this, to 
classify newly observed input values. 
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Reinforcement learning 

Reinforcement learning differs from both of the previous processes in that few or no 
training data are available to begin with. The training data required for a striven-for 
improvement are collected by an agent’ itself by carrying out the task to be optimized 
according to a fixed scheme. An assessment of the execution of the task feeds back into 
the learning process, forming a training dataset of input and output values that are used for 
further optimization steps. The approaches of reinforcement learning are exposed to the 
so-called innovation dilemma, for “exploration” and “exploitation” contradict each other. 
March [15] describes it thus: 


Exploration includes things captured by terms such as search, variation, risk taking, exper- 
imentation, play, flexibility, discovery, innovation. Exploitation includes such things as 
refinement, choice, production, efficiency, selection, implementation, execution. 


Corresponding to the learning problem, a balance for both has to be found, as, on the 
one hand, an optimal execution is sought in a partly unknown search area, and, on the 
other, this search is limited by external conditions such as costs, safety and time. 

Alongside the question of whether, and in what form, training data are available, the 
learning problem can also be distinguished based on the use of training data. 


Batch learning 

In batch, or offline learning, a set of training data is applied at a time point to make use of 
the learning methods. If the learning method produces a model, for example, this model is 
not updated by further experience gained during its use. 


Online learning 

Online learning is characterized by an iterative process, in which new experiences are 
incorporated into the learning process. The aim is to continually optimize how the task is 
tackled, in the process incorporating experience from the operation. This results in system 
behavior changing from experience and thus over time. 

These different types of learning problems require the use of various methods of 
machine learning [12]. These range from decision trees, artificial neural networks, and 
genetic algorithms to support vector methods, instance-based learning, hidden Markov 
models, value iteration and Q-learning, etc. These methods have in common that how well 
they deal with a learning problem depends on three fundamental properties. Firstly, the 
methods are only in a position to optimally solve the learning problem if data (experience) 
relevant and representative to the operation are used in sufficient quantity for learning. 
Secondly, the same applies for the quality of training data, so that the handling of noisy, 
inaccurate or partial data is especially necessary for actual measured variables. Alongside 
the test data, the assessment of performance (P) represents a further challenge. The 


‘Russell [14] defines it thus: “An agent is anything that can be viewed as perceiving its environment 
through sensors and acting upon that environment through effectors.” 
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methods will also only correctly deal with the learning problem if the assessment is valid 
with real data for the whole operational area. 


22.3.2 Examples 


The following examples serve as a small sample for areas that can be addressed with the 
processes of machine learning. 


Airbag deployment [16, 17] 

The learning problem consists of classifying sensor values to order the deployment of a 
vehicle airbag. A classifier is learned for this, which puts accidents either in the class of 
“deploy” or that of “do not deploy.” In this example, the dataset of an accident has 30 
dimensions, and consists, for instance, of acceleration, pressure and impact-sound sensors 
at various positions in the vehicle. For 40 training datasets, in which the sensor values are 
recorded for representative accidents, it is annotated (labeled) whether an airbag 
deployment would be necessary or not. 


Vehicle-path control system with artificial neural network [18] 

The ALVINN (Autonomous Land Vehicle In a Neural Network) project had the aim of 
positioning a vehicle on its optimal path within its lane. The training data consisted of the 
input parameters of the individual pixels of a camera image, and the associate output 
parameters of the steering angle. These are recorded during the journey of a human driver. 
An artificial neural network whose 960 input nodes receive the individual values of the 
30 x 32 pixels of the camera image is learned. These input nodes are connected via 4 
hidden nodes with the 30 output nodes, which each stand for a different curvature. 


22.4 Automation that Replaces the Learning Driver 


For the car industry, machine learning and artificial intelligence are of interest not only for 
the automation of driving, but also in other fields such as design, production and 
after-sales management [19]. These areas, and that of infotainment, are not our concern, 
however. Our focus is on vehicle automation, which, as presently understood, consists of 
the following components in moving a vehicle on public roads: 


1. Perception of the environmental and vehicle state variables 

2. Cognition of these state variables to arrive at a representation of the world 
3. Behavior planning based on this representation 

4. Execution of selected behavior 


These components give the properties that have, according to Mitchell (see Sect. 22.3), 
already led to successful machine-learning operations. Increasing perception of environ- 
mental and vehicle state variables gives an enormous amount of machine-readable 
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information. Firstly, this is down to continued increases in sensor performance and signal 
processing power, so that a detailed picture of the world is available for machine pro- 
cessing. Secondly, the numbers of sensors and vehicles equipped with them are rising as 
we approach full automation. It follows from this that the quality and quantity of training 
data for machine learning is increasing. The second property especially applies for certain 
areas of cognition and behavior decisions, since work on the human processes that are to 
be replaced is largely theoretical at this stage (Sect. 22.2). Based on the EU-funded 
Human Brain Project and associated studies, it is evident that there are still many ques- 
tions that remain unsolved, and that the knowledge needed for effective algorithms is 
lacking. The third property is generated by road traffic. As already described in Sect. 22.2, 
the world in which vehicles move requires adjustments to be made to changing envi- 
ronmental conditions. This is why machine learning in automation suggests itself to be 
implemented in such a way that it will be able to adjust to these changes. 

Alongside these three motivators for employing machine learning, however, there are 
particular challenges opposed to it. What the four components needed for autonomous 
driving (perception, cognition, behavior planning, behavior execution) particularly have in 
common, as opposed to other machine-learning applications, is the intervention in the 
actual behavior of the vehicle. This means that, regardless of where undesired behavior 
appears in this chain, it may develop into a breakdown or an accident. In order to debate 
the deployment of machine-learning processes in vehicle automation, we will now classify 
safety-related systems and allocate vehicle automation to one of these classes. 


22.4.1 Safety Systems 


According to 1IS026262, safety is the “absence of unreasonable risk.” The extent to which 
a system in a car (or also generally) impacts this safety can be determined in the following 
ways ([16] extended): 


1. Not safety-relevant 
Errors in these systems do not lead to any dangers for persons or the environment. 
Language recognition, where machine-learning processes are often employed on [20], 
is not safety-relevant, for example, when used in infotainment. Such systems are 
therefore already in use; although errors do regularly crop up to some extent, they do 
not negatively impact safety. 

2. Safety-relevant 
A system is deemed relevant to safety if an error in it may result in danger to persons 
or the environment. 


a) Decision-making support systems 
Here, the decision maker has the choice of whether to act on the system’s suggestions 
or not. An anesthetist, for example, receives suggestions for dosages based on 
information on the patient, operation, and previous experience. A system error would 
endanger the patient, though only when the anesthetist follows the suggestion [21]. 
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b) Systems for monitoring and diagnosis 
A system error leads to a warning failing to appear and can, if the error is not 
otherwise spotted, become a danger to people and the environment. If a diagnostic 
system in industrial machinery fails, the absence of this diagnosis may be dan- 
gerous [22]. 


3. Safety-critical 
Systems where an error directly leads to persons or the environment being endangered. 


(a) Supervised/correctable automation 
If an action is carried out automatically without additional conformation, then a 
failure of an automatic system directly leads to a hazard for people or the envi- 
ronment. If the system is additionally supervised by a human, and if the possibility 
of correcting it is provided, then this hazard may be avoided. The person super- 
vising brings the system back under control, so that human involvement creates 
fault-tolerance. It is to be kept in mind here that, particularly with increasing 
automation of processes and the further relieving of human tasks, people’s 
capacities to supervise an automated process will decreases [23]. The so-called 
congestion assistant, as partially automated vehicle control, represents just such a 
safety-critical system, as faulty system behavior would pose a direct danger. This 
danger, however, is addressed by the driver’s supervision, because the congestion 
assistant is developed in such a way that humans, by intervening, correct the faulty 
system behavior. The system is designed for controlability. 
(b) Unsupervised/non-correctable automation 

The most critical form of automation in terms of safety is that with no possibility of 
correction. Without supervision, a failure of the system leads to danger and, 
depending on the situation, damage to people or the environment. Fully automated 
driving falls in this category, as, by definition, the vehicle’s occupants are no longer 
supervising it. Undesired behavior, or a failure or malfunction not addressed by the 
system, thus leads directly to people and the environment being put in danger and 
possibly harmed. 


This categorization and the classification of autonomous driving in the unsupervised 
automation category shows why machine-learning processes as they currently stand 
cannot simply be carried over from the two levels less critical to safety (non-critical and 
relevant). Not without reason are the safety-critical examples from Sect. 22.3.2 reports on 
studies without reference to non-supervised application. 

The application of machine-learning processes in unsupervised or non-correctable 
automation requires further differentiation, as different challenges arise depending on the 
point in the vehicle’s system life cycle. 
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22.4.2 Challenges and Problem-Solving Approaches in the Various 
Phases of the System Life Cycle 


In this account, vehicle life cycles are broken up into five phases—research, development, 
operation, service and change of user/end of vehicle life—as various challenges await 
machine learning in each phase. 


22.4.2.1 Research 

When machine learning is applied in the research phase, the aim is mainly to establish 
what its processes can do. The examples range from online, offline, supervised and 
unsupervised, to reinforcement learning. Exemplary training datasets are drawn on as 
databases. The same applies when assessing process performance and robustness. This is 
carried out under controlled and/or supervised conditions, based on exemplary test data or 
test runs. In particular, controlled conditions and/or deploying trained test drivers 
(Category 3a Sect. 22.4.1) make faults tolerable, so that there are a multitude of existing 
examples. Accordingly, proving its safety does not belong to the challenges of using 
machine learning. The challenge here lies in accessing representative data for its later area 
of application. The question thus arises of whether the research findings can be transferred 
to the development and operational phases of the system life cycle. 


22.4.2.2 Development 

Learning during the development phase can be compared with offline learning. As many 
application-relevant training data as possible are selectively gathered, for example to learn 
a model during development. 

The fulfilling of safety demands in the results is, as in all other safety-relevant vehicle 
components, verified and validated, so that the vehicle can be released for production and 
operation. Afterwards, neither the learned model nor the classification change further. The 
learning process does not work online and is not adaptive, and thus does not use further 
data gained in operation as training data to update the model or classification. During use, 
it thus constitutes a time-invariant system, where the known methods for verification and 
validation remain valid. But it should be borne in mind that the results of the various 
machine-learning processes can vary in their interpretability. For example, learned deci- 
sion trees of limited extent, or a manageable set of learned rules, are easy to interpret [24] 
and thus permit the use of white—box test procedures [25]. Other methods such as random 
forests or sub-symbolic neural networks, on the other hand, are difficult for testers to 
interpret and thus represent a black-box. 

For such complex components, proving safety poses a large challenge compared to 
analytical models. Because the brute force test,” as for most analytical models, is not 


The brute force approach stands for testing all possible combinations of the parameters influencing 
the object under test behavior. 
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suitable [26] for systems with high input dimensionality, the following four counter- 
measures from Otte [24] are often used as a result: 


(a) Breaking down problems of many dimensions into submodels of fewer dimensions, 
so that the submodels can be interpreted and validated by experts 

(b) Employing reference solutions which permit the safety of the learned components to 
be analyzed 

(c) Limiting the input, output and state variables to specified value ranges, such as those 
of the training data, for example. These limits may be static, but also dependent on 
other variables 

(d) Limiting the dynamics of the input, output and state variables to minimal, maximum, 
positive or negative changes per time unit 


Each of these measures restricts the potential of machine learning in order to allow 
testing of the learned model. 


22.4.2.3 Operation 

When the fully developed and manufactured vehicle is put into operation, data accrue on 
the real usage area, the static environment, other users and their behavior, and the vehicle 
user and occupants. In addition, the vehicle has data on its machine behavior over time. 
This directly available new information, which was previously inaccessible, encourages 
the use of online learning processes, and thus also adaptive systems. The vehicle thus 
becomes a time- or experience-variant system. This further degree of freedom in a 
changing system with no additional supervision results in a particular challenge in testing 
and safety validation, one that has not yet been solved for time-invariant autonomous 
systems, see Chap. 21. Basically, there are two options for how a system that changes 
during operation could be made safe. One option is to limit its adaptivity to a clearly 
defined enveloping area, such as the strategies of Adaptive Transmission Control [27]. 
Here, input, output and state spaces are restricted to a few parameters [28], so that, from 
where we stand, validation and verification during the development phase appears to be 
possible. Should this restriction contradict the purpose of machine learning during 
operation, then an online check of the changing, time-variant and complex system 
becomes necessary [29]. The following two approaches can in turn be applied here [29]. 


Runtime verification and validation 

In contrast to conventional procedures of verification and validation during the devel- 
opment process by the developer, the system applies verification and validation methods 
during operation [26, 29, 30]. In principle, the adaptation process is seen as a feedback 
loop. Figure 22.1 shows the four stages of observation, analysis, planning and execution, 
which, according to Tamura et al. [30], are necessary for a structured examination of the 
adaptation process. This picture can be directly transferred to online learning processes. If 
a system adaptation is detected in this process, this then needs checking with runtime 
verification and validation processes before being applied to the software running. These 
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checks include whether, due to the applied changes to the system, it stays within the 
viability zone. For autonomous driving, this means checking that any changes to the 
driving robot comply with safety regulations before implementing them. 

The procedures applied here, such as model checking or theorem proving, reach their 
limits at this point, as described in Chap. 21. Using a software-in-the-loop procedure may 
also be possible, although it is questionable if there is sufficient processing power for such 
processes in production vehicles. 


Validation and verification via monitoring and fault tolerance 

If a system safety check prior to updating the software is not possible, a fault may arise 
and lead to failure and thus also danger. To avoid this, the system is to be designed as fault 
tolerant. Such a fault-tolerant system fundamentally requires two components [31]. 
Firstly, monitoring of system states and behavior to decide, based on an analysis, whether 
there is a fault. Secondly, redundancy is required that can be transferred to in case of a 
fault. Figure 22.2 shows this set-up schematically. This principle corresponds to a human 
supervisor who takes over a part-automated vehicle control system when a fault occurs. 


What this shows is that machine learning during operation poses a challenge, especially 
for validating safe behavior. Both procedures—runtime verification and validation and 
verification and validation through monitoring—need a way to measure safe driving. 
Approaches for such measurements are outlined in Sect. 22.4.3. 

Another approach is supplied here by a comparison with human learning. Road users 
accept that humans, with no further screening, learn based on the measures they take while 
driving and adjust their behavior accordingly. Checking whether adjusted behavior 
complies with traffic regulations does not transpire directly but, rather, sporadically via 
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police speeding and traffic checks. In addition, other road users report highly erratic 
behavior, such as accidents, so that human drivers receive feedback in their learning 
process. Transferred to the technical system, this would mean that machine learning leads 
directly to an adjustment of behavior. The test or check of whether this adjustment was 
legitimate would follow in retrospect from other road users, the police or a special 
supervisory authority. This approach reduces the demands placed on online validation and 
verification, as the skills of other road users are incorporated. If this test does not take 
place until after the functions have been modified, and if there is also no other possibility 
of intervention (in the control system), operating the updated but untested functions would 
pose higher risks. 


22.4.2.4 Service 

Alongside machine learning during development and operation, there is a further phase in 
the system life cycle where learning can take place. As part of servicing, training data 
gathered by the vehicle can be downloaded and the vehicle functions updated. This does 
not necessarily require the vehicle’s physical presence [32]. This procedure opens up the 
feedback loop in Fig. 22.1. Corresponding to a further development stage, training data 
and planned adaptations can be tested, so that the software system can be updated later 
after safety has been assured. As these methods of machine learning can involve personal 
data leaving the vehicle, security as well as safety needs to be borne in mind. For a more 
in-depth look at this, see Chap. 24. 


22.4.2.5 Change of User/End of Vehicle Life 

Should, as is hoped, a vehicle be able to personalize how it drives for a user, or optimize 
this for an area of operation, then, with a change of user or at the end of its life, these 
learned capabilities and knowledge should stay with the user and not the vehicle. This 
capacity then becomes of particular interest when, for example, ownership patterns change 
as in Vehicle on Demand (see Chap. 2) where the user does not purchase a car but only its 
mobility service. In principle, it is not difficult for a technical system to transfer knowl- 
edge. It is actually a strength of artificial systems that they can transfer this information 
without the long-winded learning process. This is examined in more depth in Sect. 22.5. 


22.4.3 Measures of Safe Driving 


As described in the previous chapters, an evaluation of the vehicle’s driving in safety 
terms is needed for both the machine-learning process in general and verification and 
validation during operation. In the first instance, it can of course be seen retrospectively if 
an accident has taken place, with what impact speed and energy, and how it came about. 
This measurement has the drawback that the accident should not, if possible, have taken 
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place in the first place. It follows from this that, for a safe system, accidents will be an 
extremely rare event and thus hardly suitable for learning from. 

What is needed is an evaluation that classifies a journey as unsafe before it exceeds 
physical driving limits. To this end, we shall differentiate between deterministic and 
stochastic procedures in hazard assessment, as found in [33, 34]. 


22.4.3.1 Deterministic Procedures in Hazard Assessment 

Following [35], we shall in addition distinguish between identifiers from driving dynamics 
and identifiers from distances. The easiest values to determine, though with limited 
informative value, are the limits for lateral and longitudinal acceleration and yaw rate. In 
the 100 Cars Study [33], longitudinal accelerations of greater that 0.7 g are used as 
triggers for detecting unsafe situations. Identifying critical situations with variables from 
the ego-vehicle is not adequate, as other road users can bring even stationary vehicles into 
dangerous situations. It is easy to see that a vehicle’s safety is also influenced by other 
traffic in its immediate surroundings. 

If the environment is at the beginning first reduced to parallel traffic on one lane in each 
direction, time-to-collision (TTC) or its reciprocal value give an indication of how safe a 
situation is. For example, in ISO 22839 (Forward vehicle collision mitigation systems), 

Xe 


TTC = — 


Vy 


defines the time that elapses until the ego-vehicle collides with an object at distance xe, 
assuming the relative speed v, = (vego — Vobj) remains constant. This measure can be 
applied to both the preceding and the following vehicle. From the TTC, Chan [34] defines 
a criticality index for which it is assumed that the severity of an accident is proportional to 
the square of the speed: 


2 


v 
Criticality Index = ——— 
riticality Index TTC 


If the speed between the vehicles does not remain constant, the enhanced TTC is used. 
In ISO 22839, this is derived thus: 


v, — 4 / V2 — 2 - ap + Xe 
ETTC = 2 . 


ay 


This equation only applies so long as the relative acceleration a, = (dobj — aego) 
remains constant. If a vehicle comes to a stop, the equation needs adjusting, see Winner 
[35] on this. These values give an assessment of a state, equivalent to a situation analysis. 
To enable an assessment of driving safety for all situations, the following procedures from 
[36] are recommended: 
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— Number of Conflicts (NOC) 
— Time Exposed TTC (TET) 
— Time Integrated TTC (TIT) 


The names of the procedures speak for themselves, so that we shall not dwell on them 
here, but rather refer the reader to [36, 37]. Further simple measure include time headway 


Xe 


i= 
Vego 


and the necessary delay areq to avoid a rear-end collision. Further approaches based on the 
foregoing can be found in [37-39]. 

When vehicles, objects and accelerations moving in a lateral direction are included, for 
example, when studying situations at junctions, the metrics for a safety assessment have to 
be expanded. Easily the simplest approach is Post-Encroachment Time (PET). This 
temporal variable is defined by [40] as “time between the moment that the first road user 
leaves the path of the second and the moment that the second road user reaches the path of 
the first.” 

When observing the lateral direction, there are more objects than just the two 
object-vehicles in relation to the ego-vehicle. These can influence the safety assessment 
statically, but also in principle dynamically from any direction on the vehicle plane. 
Tamke’s [41] approach is, for example, to identify the distance, and the distance’s time 
derivation, to all objects in the vicinity of the ego-vehicle using Euclidian norms. 
The TTC is determined based on these variables by ascertaining the time until contact 
with the vehicle’s bodywork using predictions of behavior. This approach is still classified 
as a deterministic procedure at this point, as the behavior of the ego-vehicle and the 
dynamic objects follow the “constant turn and constant acceleration approach.” The 
approach per se, however, also allows predictions to be made non-deterministically. 

Deterministic procedures are suitable for ex-post safety assessments of a carried-out 
maneuver or situation. If an online assessment of situations as they happen and a pre- 
diction on a time horizon greater than 1 s is desired, however, then its application per se 
will be flawed as long as the situation contains uncertainties. Uncertainties here imply that 
the development of a situation over time not only has a potential deterministic procedure, 
as is often assumed in “constant turn and constant acceleration” models of simplicity, but 
rather that many different situations can occur. For example, in calculating the TTC, the 
car in front could, instead of slowing down, accelerate to alleviate a critical situation. In 
order to incorporate these uncertainties into the hazard assessment, we will now take a 
brief look at stochastic procedures. 


22.4.3.2 Stochastic Methods in Hazard Assessment 

A hazard assessment of two vehicles simply passing each other, as shown in Fig. 22.3, 
clearly encourages the use of stochastic procedures. If deterministic behavior and an 
extrapolation of speed are assumed, passing like this would pose no danger, as the 
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Fig. 22.3 Comparison of 
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trajectories and areas occupied by the vehicles do not cross. This looks different when 
uncertainties are taken into consideration. If a human-driven vehicle (Fig. 22.3 lower lane, 
black) does not stay in its lane, this can be hazardous for the autonomous vehicle 
(Fig. 22.3 upper lane, orange) and the immediate surroundings. 

The associated risk results from the probability of an accident and its potential severity. 
Both values involve unknowns that need to be estimated as accurately as possible. 

The principal approach here [42] for determining probability is to predict the trajec- 
tories of the ego-vehicle and objects in its vicinity, based on measured state variables. Due 
to the uncertainties involving human drivers, sensors and actuators mentioned above, as 
well as the interaction between the objects, there is not only one trajectory, but rather a 
probability distribution of the states of all objects over time. If the potential areas occupied 
by the objects overlap, an accident is probable. The possible states of the objects result 
from the dynamic models used and the defined limits for the dynamic variables. In [43], a 
single-track model for vehicles is used here to find a compromise between prediction 
accuracy and computing time. In addition, dynamic variables such as acceleration and 
steering rate are limited, according to the analysis of the author [43], to non-critical and 
typical values. In [43, 44] an overview of alternative methods can be found. All methods 
have in common that the dynamic simulation of a vehicle cannot proceed analytically 
[41], so that numerical methods with accompanying discretization and simplification are 
to be used. 

Including severity in the hazard assessment is approximated in [45] by a relative 
assessment of each accident based on its inelastic collision. This corresponds to the 
approach based on the Potential Collision Energy (PCE) [36]. Further, however, no 
approach has been found that determines both severity and probability in combination. 
One reason for this is imprecise analytical regression methods [46], another is 
computing-intensive Finite Element Methods (FEM), which are currently used in other 
fields for determining accident severity [47]. Meier et al. [46] provides a new approach 


466 W. Wachenfeld and H. Winner 


here based on symbolic regression. Using a crash-situation database (produced from FEM 
calculations), regression functions are learned which predict accident severity in a situ- 
ation to a few milliseconds. This uses pre-crash information such as vehicle mass, speeds, 
collision point and collision angle. The downside of this approach is its limited inter- 
pretability, as the regression model does not include any physical variables. If this 
approach gave a valid prediction for severity, it would be possible to extend an assessment 
of risk into one of severity. 

The above-mentioned procedures are not yet sufficient to assess adaptive automated 
driving’s safety, for the following reasons. Firstly, all the approaches are based on a series 
of simplifications, such as leaving out weather conditions, simplifying the driving 
dynamics, or not including sensor uncertainties. Secondly, the procedures as they stand do 
not provide any validated and combined ascertainment of the probabilities and severity of 
accidents. A general definition and assessment of vehicle-driving safety therefore does not 
currently exist. 

However, the ongoing progress in vehicle automation does provide enabling factors. 
These are, firstly, removing the uncertainty of the driver (ego-vehicle). Although human 
behavior continues to be present in the form of other road users, the trajectory of the 
ego-vehicle is known within its control performance. Moreover, current vehicles’ sensor 
performance is rising, reducing uncertainties in the state of the object. Further, additional 
information on the surroundings is exchanged via V2X communication, thus improving 
the points of reference for hazard assessment in both quality and quantity. 


22.5 Automation as Part of a Learning Collective Group 


In this chapter, our analysis of learning vehicles has so far restricted itself to the system 
life cycle of a particular vehicle. What vehicle automation implicitly brings with it, 
however, is the duplication of hardware and software across a whole group of vehicles in 
the aimed-for mass production. Vehicles operating in road traffic would consequently 
have the same capabilities. On the one hand, this has the drawback that driving errors, 
breakdowns and accident types would affect not only one vehicle but the whole group. On 
the other, it gives adaptive systems a further degree of freedom. The option of exchanging 
data makes collective learning during operation possible. Two approaches may in prin- 
ciple be distinguished here [48]: agent-based machine learning and machine learning with 
agents. In the former (also often called agent-based swarm intelligence), the learning 
collective system is made up of a multitude of networked agents with limited cognitive 
capacity. The behavior of animals such as ants or bees is often drawn on in this connection 
[49]. In contrast, though, machine learning with agents also consists of several agents, 
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these employ the procedures described in Sect. 22.3. These two approaches differ in the 
fundamental stages of machine learning in terms of: 


— generation of collective experience 
— collective performance evaluation 
— derivation of learned models and knowledge 


Essentially, the approaches can be applied as soon as data from real situations has been 
gathered. This raises questions: At which position of a group is relevant information 
gathered from the data and assessed in terms of the learning problem and performance 
measurements? Can learning methods be used that are based on this? Not least for reasons 
of limited data-transfer bandwidth, it will be necessary to transfer pre-processed data or 
even learned models and knowledge rather than raw sensor data. So long as the partici- 
pating agents/vehicles belong to a series and software release, there will be challenges for 
the integrity of the transferred information, although not in compatibility and trustwor- 
thiness between agents. So-called homogeneous teams exist in which how and what is 
being learned is known among the group. If the aim, however, is to expand the database 
which learning methods are applied to, vehicles with different software or even of different 
manufacturers could also be networked to each other. This amounts to a collective of 
heterogeneous vehicles in which potentially different machine-learning procedures are 
used, and the knowledge representation is likewise heterogeneous. Reference [50] gives 
examples from other areas of how such collectives could in principle be handled. 
Essentially, as well as vehicle robots, there are other agents, such as smartphones or also, 
in future, service robots, which likewise gather data covering completely different areas to 
those accessible to the driving robot. The currently highest conceivable level of 
connectivity, and by some distance the largest database, is the internet. The autonomous 
vehicle as a web-enabled device permits a great number of applications and functions, for 
better or worse. Not least, IBM’s Watson Project shows that part of the knowledge 
archived in the internet is also comprehensible to machines. Information made accessible 
on the internet by any authority would therefore not need to be learned through experience 
first to influence an autonomous vehicle’s behavior. On the other hand, access to any 
(unauthorized or anonymous) source threatens to create problems in terms of both road 
traffic safety and data security (see Chap. 24). 


22.6 Conclusion 


Machine learning is of great interest to current research, as the quality and quantity of 
available data is constantly increasing and, in addition, vehicle automation is throwing up 
questions that can only be partly solved with conventional analytical approaches. In 
carrying research findings over to the development of functions in the driving of auton- 
omous vehicle, proving their safe use in unsupervised safety-critical systems with no 
possibility of correction poses the greatest challenge. Therefore, according to the authors’ 
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knowledge, learned models that do not change after testing and approval can already be 
found in current mass-production vehicles. Systems such as Adaptive Transmission 
Control are not the subject of our examination due to their negligible adaptive parameters 
in clearly defined limited value ranges. However, learning and adaptation while in 
operation is giving automation an extra degree of freedom. 

Exploiting this degree of freedom is motivated by the possibility of optimizing auton- 
omous journeys, compensating for the loss of people’s capacity to adjust and learn, and 
individualizing vehicle-driving. This chapter has highlighted that applying machine 
learning in vehicle automation during operation requires greater attention in terms of both 
road safety and data security. There is currently no valid measure for assessing traffic safety 
in respect of risk. Therefore, it seems clear that the use of adaptive machine-learning 
processes while in operation first requires a fault-tolerant set-up with redundant conven- 
tional systems, with the latter serving to assess road safety. It is thus to be expected that 
machine learning while in operation (adaptive systems) will initially only optimize vehicle 
automation within the framework of the conventional system. 

Due to the challenges highlighted with respect to proving the safe behavior of 
time-invariant adaptive systems, it appears necessary to do intensive further research on 
runtime verification and validation. The same holds for the above-mentioned applied 
non-adaptive systems and their demonstration of safety. Although there is copious liter- 
ature on examples that have already been successfully introduced, these mostly come from 
other fields that do not place comparable demands on a product. 

In this chapter, we have examined the question of data security only peripherally—for 
a more in-depth discussion, see Chap. 24. Learning approaches require data and hence 
information on occupants, the vehicle and the environment. Data protection is thus of the 
same relevance as road safety. It should be pointed out that the environment also contains 
people, which implies protecting their data. The quality and quantity of the sensors needed 
for vehicle automation is a boost for machine learning on the one hand, but on the other 
they are regarded with suspicion from a data protection point of view. One special 
property of vehicle sensors is, in addition, that they currently are to a great extent not 
physically covered when the vehicle or function is not active. With the application of 
machine learning, data security should also accordingly be addressed directly. 

Nevertheless, the application of networked agents and learning systems has its 
advantages, whose effects are not to be underestimated. Collectively learning agents need 
not acquire available knowledge slowly. Instead, this information can be copied and 
pasted to the next vehicle or software generation. This, in combination with access to the 
large quantity of electronically recorded information, has the potential to change the 
driving of vehicles, road traffic and thus people’s overall (mobility) behavior. This makes 
the findings gained for driving equally interesting to research into medical robots, and also 
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domestic robots with human contact. Due to the similar conditions, the reverse also 
applies, which speaks for close cooperation between vehicle technology and robotics. 
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Andreas Reschka 


The development of autonomous vehicles currently focuses on the functionality of vehicle 
guidance systems.' Numerous demonstrations of experimental vehicles have shown their 
impressive capabilities—listed here with the most recent named first. For example, the 
drive on the Bertha-Benz route undertaken by the Karlsruhe Institute for Technology and 
Daimler AG [69], the Stadtpilot project of the Technische Universitat Braunschweig 
[41, 60], activities of Google Inc. [13, 59], the BRAiVE Research Institute and the VIAC 
Project of the VisLab Institute of the University of Parma [4, 8], the research activities of 
the Collaborative Research Centre 28 of the German Research Foundation (DFG) [31, 55, 
57] and the results of the DARPA Urban Challenge [51-53]. If the experimental vehicles 
were driving in traffic on public roads, a safety driver” was always in the vehicle to 
monitor the technical system. This person had to intervene if a technical defect occurred 
meaning that the current situation was beyond the capabilities of the vehicle or if another 


'A vehicle guidance system is a technical system that steers the vehicle without human 
intervention. Unlike driver assistance systems, no monitoring by a human driver is necessary. The 
system, consisting of the vehicle and vehicle guidance system, forms an “autonomous vehicle”. The 
meaning of the term “driving robot” is very similar to that of the vehicle guidance system. However 
it is frequently understood as a mechatronic system, which operates a vehicle like a human (see 
http://www.uni-ulm.de/in/mrm/forschung/mechatronik/kognitiver-fahrroboter.html). To avoid con- 
fusing the two, the term “driving robot” will not be used in this article. 

The article will use the terms “driver” and “safety driver” to indicate human drivers and safety 
drivers. 
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event necessitated this. This necessary monitoring of the technical system means that the 
indicated test drives on public roads are classified as semi-automated according to [20]. 
However, the aim of future vehicle guidance systems with higher levels of automation is 
to operate the systems independently in all situations without human monitoring. 

Therefore, in the development of vehicle guidance systems, a safety concept is required 
that covers the various steps of the development process, such as the specification, design, 
development and the functional tests. In addition safety functions that can attain or attempt 
to sustain a so-called safe state are required in the system. 


23.1 Safe State 


The use of the term safe state is often ambiguous. Safety is a relative concept and depends 
on the individual perception of the observer. According to the ISO 26262 standard, an 
operating mode of a system or an arrangement of systems can be regarded as safe when 
there is no unreasonable risk (see “safe state”, ISO 26262, Part I, 1.102 [30]). This means 
that a safe state is only present when the current and future risk is below a threshold 
accepted in society (see “unreasonable risk”, ISO 26262, Part I, 1.136 [30]). This 
threshold is to be regarded as a value of what is not acceptable in a specific context 
according to social, moral or ethical considerations (see ISO 26262, Part I, 1.136 [30]). 
Risk is to be understood as a combination of the probability of occurrence and the severity 
of the personal injury (see “risk” and “harm”, ISO 26262, Part I, 1.99 and 1.56). 

This definition allows us to understand a safe state as a state where risk from the system 
is reasonable. The frequently used term risk-minimized condition (e.g. in [20]) can be 
misunderstood as this does not place the risk in relation to an accepted risk and does not 
specify whether the system that is being operated with minimum risk is also safe. 

The essential challenge when using the term safe state, in the sense of a condition with 
an acceptable level of risk for passengers and other road users, is the identification of a 
threshold under which the risk level is acceptable. When operating an automated vehicle, 
the level of acceptable risk depends on the current situation of the vehicle. The situation 
includes the following, according to [21] and [43]: 


— All stationary and dynamic objects relevant to a driving decision 

— The intention of the dynamic objects including the autonomous vehicle 
— The pertinent legal conditions 

— The mission of the autonomous vehicle 

— The current power capability of the autonomous vehicle. 


Therefore, for an autonomous vehicle, the current risk must be continuously deter- 
mined on the basis of the current situation and a comparison of the risk with the threshold 
value that is regarded as still just about acceptable. In the sense of the ISO 26262 standard, 
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this means that the likelihood of personal injury and the severity of the injuries must be 
determined for every situation and all ways in which the situation can develop and the 
courses of action that present a reasonable and acceptable level of risk must be identified. 
The author is currently not aware of a technical solution for this problem. 


23.1.1 Safe State in Driver’s Assistance Systems Used 
in Series-Production Vehicles 


In the case of driver’s assistance systems, the driver monitors the technical system and has 
to pay close attention to the traffic situation. The driver is supported when driving. The 
current Mercedes-Benz p Class models are available with a system called “DISTRONIC 
PLUS with Steering Assist and Stop&Go Pilot”. This system supports the driver in 
guiding the vehicle both laterally as well as longitudinally [49]. The driver still needs to 
follow events on the road, and the steering assist system deactivates after a specified time 
if the driver takes his hands off the steering wheel: 


If the Steering Assist with Stop&Go Pilot detects that the driver has taken his hands off the 
steering wheel during the journey, depending on the driving situation, the steering wheel 
inertia sensor, the environment detected and the speed, the driver is warned in the instrument 
cluster. If the driver does not respond, a warning tone is sounded and the steering assist is 
deactivated. (Translated [49]) 


For this reason, the system is to be regarded as semi-automated according to the 
standards laid out in [20] or as partial automation according to [48]. The longitudinal 
guidance can also switch off and cede control to the driver with a corresponding signal as 
soon as technical faults develop or—depending on the way the system is set—if specific 
threshold values such as a minimum speed are no longer met [62]. 

Hörwick and Siedersberger [25] presents a safety concept for semi-automated and 
highly automated driver assistance systems. However, the terms are again used differently 
here. In [25], fully automated DAS (FA-DAS) actually means semi-automated according 
to [20], as the driver has to monitor lateral and longitudinal motion. Autonomous DAS 
(A-DAS) in [25] has the same meaning as fully automated according to [20], as the driver 
does not need to constantly monitor the system and the system can attain a safe state on its 
own. According to [24], a safe state is attained by stopping at a nonhazardous location. As 
the focus is on a system for automated driving in traffic jams on the freeway up to 60 km/h 
(approx. 37 mph), stopping on a lane until a human takes over control appears as a safe 
state. The relative speeds are assumed to be low due to the traffic jam [24, 25]. 

A study on the potential of automated driving on freeways comes to the same con- 
clusion [45]. This was drawn up as part of the development of an accident assistance 
system that can stop a vehicle (safe state) in the event of the driver losing consciousness or 
not being able to guide the vehicle for other reasons [32, 45]. Such a system is also 
presented in [37]. The safety requirements here are higher than those for a traffic jam 
assistance system, as the vehicle is not supposed to simply stop but leave flowing traffic 
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and come to a standstill on the shoulder. In addition the system was designed for normal 
freeway traffic and not for traffic jams, meaning the very high relative speeds can come 
into play. This means that the requirements of the system are very high in terms of 
reliability and environment/situation recognition, as other drivers/vehicles must be 
observed when changing lanes onto the shoulder [45]. Redundant sensors that cover at 
least the areas in front, to the rear and in countries that drive on the right, to the right side 
of the vehicle are required here. The benefits of such emergency assistance systems are 
still present even if the system is not fully available due to technical defects. A vehicle that 
is out of control on the freeway is more dangerous than a vehicle moving slowly or at a 
standstill that is indicating in a suitable manner—even if switching lanes to the shoulder is 
not possible [32, 37]. 

In summary, it is possible to say that, if a driver is present in the vehicle, driver 
assistance systems can attain a safe state by handing control to the driver or by braking to 
a standstill. The emergency assistance systems mentioned here can attempt to reach the 
shoulder, however the requirements for this are relatively high. Even with systems with 
higher levels of automation, handing over control to a driver who may be in the vehicle 
and braking to a standstill comprise possible ways in which a safe state can be attained. 


23.1.2 Safe State in Experimental Autonomous Vehicles 


The following projects focus on autonomous vehicles on all types of roads and in all 
environments. The developed systems should be able to take on the task of driving 
completely and no longer require humans for monitoring purposes. There are only a few 
publications on safety functions and safety concepts of the various projects. This could be 
because it is relatively simple to deploy a human to monitor the vehicle and therefore not 
to make use of comprehensive safety systems and also because the functional safety of the 
systems for autonomous operation has not yet received the attention this field deserves. 
The projects taken into consideration are listed chronologically and the levels of 
automation according to [20] and the safety mechanisms used are highlighted. 

The projects from the 1950s to the 1990s focused solely on the functional aspects of 
automatic vehicle guidance, such as the first attempts to link infrastructure and the vehicle 
in the General Motors Research Labs. This project involved implanting magnets in the 
road surface that the vehicle could detect. The driver was required to maintain a constant 
vigilance over the road traffic and the system [17]. In the 1970s and ’80s in Japan research 
was conducted in the field of vehicle automation with the recognition of driving lanes with 
imaging cameras. Again, the system was constantly monitored by the driver [58]. The 
same applies for the research conducted in the 90s, for example the experiment No hands 
across America 1995 of the Carnegie Mellon University [50, 56]. In this case only the 
lateral guidance of the vehicle was automated. In terms of research in Europe, a test drive 
conducted by the University of the Federal Armed Forces from Munich to Odense with 
the VaMoRs-P experimental vehicle (again in 1995) must be mentioned. During this trip, 
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the lateral and longitudinal guidance was conducted automatically and supervised by the 
driver. In addition, the automatic lane changes were initiated by the driver [36]. The 
ARGO experimental vehicle of the VisLab Institute of the University of Parma achieved a 
long-distance record in 1998. The level of automation covered not only lateral and lon- 
gitudinal guidance but also lane changes initiated by the monitoring driver [7]. All of the 
named projects are to be classified as semi-automated according to [20]. The safe state 
was achieved by handing vehicle control to a monitoring driver or restored by inter- 
ventions by the monitoring driver. A comprehensive overview of the developments of the 
1990s can be found in Dickmanns’s work [14]. The focus here is on camera-based image 
processing. 

The Autonomes Fahren (Autonomous Driving) project in Lower Saxony in 1998 also 
examined the development of autonomous vehicles. Binfet-Kull et al. [6] describes a 
safety concept that involves various methods that are feasible and logical parts of today’s 
systems. Table 23.1 lists error codes, the meaning of which and resulting actions could be 
executed by the vehicle in order to attain a safe state. The selected categorization is also 
possible in terms of the definitions of [20]. A detailed discussion of the actions will be 
given in the context of the respective safe states for the use cases in Chap. 2. 

In the DARPA Urban Challenge, all participating autonomous vehicles without drivers 
were operated on an enclosed military base. The safety concept was prescribed by 
DARPA and included an option for immediately stopping a vehicle via remote control and 
by means of an emergency switch on the outside of the vehicle [2]. The safety concept of 
the CarOLO team of the Technische Universitat Braunschweig used the time after the 
emergency stop to conduct self-rectification actions [19, 22, 44]. This allowed 
the autonomous vehicle to restart faulty components of the vehicle guidance system [2]. 
The other teams also followed a similar approach in the final of the Urban Challenge 
[51-53]. 


Table 23.1 Error codes from [6] 


Error Meaning Action 

code 

FO “OK!” No action 

Fl “Maintenance Take account of necessary maintenance 
required” 

F2 “Return home” Return to maintenance/service station with reduced speed 

F3 “Safe parking” Stop at the next available parking space 

F4 “Immediate Stop the vehicle immediately at the side of the road without 
stop” endangering other road users 

F5 “Emergency Immediate, controlled braking to a standstill with steering 
stop” function, if possible 

F6 “Emergency Immediate stopping of the vehicle by activating the brakes 


braking” 
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Emergency stopping via remote control as a last resort to attain a safe state was only 
possible because the vehicles were driving in a secured area, followed by observation 
vehicles. The other road users were either vehicles driven by professional drivers or other 
autonomous vehicles. A test involving vehicles with the capabilities of the experimental 
vehicles involved on public roads would have been too dangerous. 

The Stadtpilot project of the Technische Universitat Braunschweig has demonstrated 
semi-autonomous vehicles on public roads since 2010 [41, 60]. The research of this 
project focuses on fully-automated operation of the experimental vehicle—Leonie. 
However, when driving on public roads a safety driver has to monitor traffic and intervene 
before dangerous situations can arise. 

The vehicle guidance system transfers control of the vehicle to the safety driver if it 
reaches the limits of the system’s abilities or if system faults occur. As no other safety 
actions may be performed on public roads, the safe state is to transfer control to the driver. 
As the system is partially capable of determining its own performance, for example the 
quality of localization, other actions are then also possible. For example stopping at the 
side of the road or even on the current driving lane is feasible, continuing travel with 
greater distances to the vehicles ahead and with reduced speed is also possible, however, 
this has only been tested on test tracks [46, 47]. 

Stanford University and the Volkswagen Electronic Research Lab 2010 demonstrated 
automated driving with the Junior 3 experimental vehicle [35, 54]. The design of the 
experimental vehicle is similar to that of Leonie from the Stadtpilot project. Automated 
driving functions are controlled by silver switches. These facilitate a connection between 
the vehicle guidance system and the actuators of the vehicle. In the fail-safe state, these 
switches are open and there is no connection between the vehicle guidance system and the 
vehicle. This means that control is in the hands of the necessary safety drivers. One special 
feature is the valet parking function of the vehicle that can be used without a safety driver 
in a closed-off area. For safety purposes the vehicle has a so-called e-stop function that 
was used in a similar way to the one in the DARPA Urban Challenge. The vehicle 
guidance system is monitored by a health monitor that detects malfunctions of software 
modules and triggers self-rectification functions. In addition the vehicle is capable of 
operating the brakes and stopping independently. The stationary vehicle thereby attains 
the safe state via the e-stop and the safety system. 

In 2012, the VisLab Institute of the University of Parma demonstrated semi-automated 
driving on public roads in a partially closed-off area with the BRAiVE experimental 
vehicle. On parts of the circuit there were no drivers in the driver’s seat and only the front 
passenger could intervene with an emergency stop button. An e-stop function was also 
integrated [8, 23]. 

After the DARPA Urban Challenge, work continued at Carnegie Mellon University on 
the BOSS experimental vehicle and an approach for monitoring and reconfiguration in 
real-time was developed and published [33]. This approach, called SAFER, uses redundant 
software components that are usually switched to stand-by in normal operation and they 
can be activated as required. This makes it possible to switch a defective component to a 
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redundant solution within a very short time. As no hardware monitoring takes place, no 
sensors and actuators are monitored, which means the approach can be used to supplement 
hardware redundancy methods. 

The last example of current autonomous vehicles development projects is the Self 
Driving Car project of Google Inc. As a first step of this project, vehicles approaching a 
stage in which they are ready for series production were equipped with sensors and 
operated on public roads in Nevada and California [13, 59]. Even though there is only 
sparse information on the technology used in vehicles, use without safety drivers does not 
seem possible at present. As described in [13], there are numerous situations that make too 
many demands on the performance of the system. The safe state of these vehicles also 
means the driver taking control. In 2014 a prototype was presented without operating 
elements for the driver and therefore can certainly be classified according to [20] as fully 
automated, as there are no possibilities for overriding the controls. However, this vehicle 
has not been used on public roads to date. 


23.1.3 Summary 


As the projects described show, there is currently no comprehensive safety concept that 
covers all requirements of vehicles without safety drivers on public roads. However, some 
of the projects have demonstrated powerful safety functions that cover the different sit- 
uations and events on the streets. If one assumes that in future the safe state is to attain the 
specifications of the “ADOPTED REGULATION OF THE DEPARTMENT OF MOTOR 
VEHICLES” section 16.2 (d) from Nevada, an autonomous vehicle must be capable of 
leaving the traffic flow at any time during the journey and stopping at the side of the road 
or on the shoulder [39]. This would require a lane change which in turn would depend on 
reliably functioning environment perception, decision-making and their implementation. 
Simply to stop as performed in some of the projects along with handing control of the 
vehicle to the safety driver, is not sufficient. The use of a combination of the preset vehicle 
safety function approaches seems therefore to be necessary—probably other safety 
measures need to be taken in order to attain a higher level of reliability [39]. 


23.2 Safety Concepts in Use in Series-Production in Other 
Disciplines 


In addition to autonomous vehicles and driver assistance systems, functional safety also 
plays an important role in other technological areas. The following section details safety 
concepts from other disciplines and examines their suitability for autonomous vehicles. 
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23.2.1 Track Vehicles 


Track vehicles have been operated automatically for several years already. On public 
transport vehicles, a train driver is present in most cases to monitor the function of the 
systems [66]. Unlike the autonomous vehicles under consideration here, safety functions 
are frequently integrated in the infrastructure, for example track usage is coordinated in 
centralized control centers and the monitoring components are integrated in the tracks. 
The control systems have the task of avoiding collisions by ensuring the track sections are 
only ever occupied by one train. This is implemented by sensors and systems (wayside 
centric), such as axle counters at the entrance and exit of a section of track [42]. If a 
section is occupied, the signals are switched accordingly to prevent another train entering. 
The avoidance of collisions is therefore primarily a logistical problem particular to traffic 
operation technology. The mechanical lateral guidance without any degree of freedom on 
rail vehicles reduces the complexity of the situations and the number of options for action. 
Put simply, it all comes down to trains driving along free sections of track at a suitable 
speed to avoid derailing. Monitoring the track in front of the train is not possible with 
surround sensors due to the long stopping distances. However trains and carriages have 
emergency stop functions that can be triggered by passengers and train drivers and even 
externally on driverless trains. 

On driverless trains, the speed of the journey is regulated automatically and in addition 
to monitoring track occupancy by the infrastructure, the systems also have on-board 
mechanisms (vehicle-centric). Communication between the control center and the vehicle 
is performed via wireless technology in exactly the same way as communication between 
platforms and driverless underground trains. Here, a redundant door monitoring system on 
the platform and in the train can be used to prevent hazards arising from closing doors. 
The communication-based train control (CBTC) has become a standard that is used in 
numerous railway systems all over the world [42]. 

Such an automatic train driving system is used in the RUBIN underground system in 
Nuremberg. Traffic on the track is a mix of driverless trains and trains with drivers.” An 
essential component of the safety concept is the monitoring of the doors [38]. Components 
of the automatic train protection systems (ATP) and automatic train operation (ATO) are 
used; these are divided between stationary and on-board components. With ATP the speed 
is kept below existing limits and safety stops and emergency stops are triggered. The 
system must therefore fulfill the requirements of safety integrity level 4 (highest safety 
level) according to the European standard IEC50128:2011 [29]. The necessary hardware 
and software is inexpensive in relation to the comparatively high costs of track vehicles 
compared with road vehicles. 


Information on the RUBIN project of Siemens AG: http://www.siemens.com/innovation/en/ 
publikationen/publications_pof/pof_spring_2008/tailored_solutions/fahrerlose_ubahn.htm. 
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23.2.2 Purely Electrical Control of Actuators (X-by-Wire) 


On autonomous vehicles the actuators are triggered and controlled by means of electrical 
signals. Gas, brakes, steering and special functions are controlled by controllers. The 
X-by-Wire technology is not yet completely available in series-production vehicles. The 
electronic gas pedal, the electromechanical steering and the electrohydraulic brake system 
have been around for several years. However the steering and brakes still have a 
mechanical/hydraulic linkage that is mostly permanent and only available as a fallback in 
seldom cases if the electrical system fails.* The driver can thereby control the vehicle even 
without the electronic systems. 

For autonomous vehicles, the actuators must therefore have several redundant control 
circuits, as is the case in airplanes, for example. Both communications systems between 
operating elements, control devices and actuators as well as operating elements, control 
devices and actuators (including the energy supply) are installed multiple times so that in 
the event of a fault, the redundant systems can be used [3]. In [67], a threefold redundant 
control system for a Boeing 777 passenger airplane is presented. Each safety-relevant 
component of the airplane control system is implemented in three different ways to 
implement a high level of availability of the controls to the pilots or the autopilot. Due to 
the criticality of vehicle piloting, in addition to the autopilots on passenger planes, it is 
mandatory to have two human pilots [15]. 

The architecture used in airplanes and also the hardware and software used for 
implementing this would appear to also be suitable for use in vehicles. In airplanes, the 
high costs of such redundant systems are not so significant when looked at in relation to 
the high overall costs of the vehicle. For road vehicles, an analogous use of three-fold 
redundant systems would entail three times the investment in development and three times 
the amount of hardware compared to today’s systems in vehicles. It remains to be seen 
whether threefold redundancy of the systems is really necessary in vehicles. 

In air traffic, the flight paths are assigned by a central air traffic control center and the 
autopilots keep to these prescribed routes. Therefore an autopilot in an airplane can be 
compared with a semi-automated driver’s assistance system, as the pilots have the duty of 
monitoring the system. On unmanned airplanes, the monitoring by the pilot is omitted and 
the requirements of the airplane guidance systems are greater. Risks are reduced by using 
flight paths that only fly over sparsely populated areas. As there are no persons on board, 
crashing into an empty field is a possibility as nobody will be injured [34]. 


“In 2012, the vehicle manufacturer Nissan presented a steering system that created a mechanical 
connection via a coupling in the event of a fault: http://www.newsroom.nissan-europe.com/de/de-de/ 
Media/Media.aspx?mediaid=979 10. 
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23.2.3 Robotics 


Mobile robots can pose a danger to themselves and their surroundings due to collisions 
with objects, persons and other living creatures and by overlooking ledges, ditches, steps, 
etc. [1, 10, 18]. Automated manipulators that are either used on stationary or mobile 
platforms can endanger people by moving their joints and colliding with the humans or by 
injuring them with the tools they are using. Therefore, for both the mobile robot and the 
manipulators, the safe state is the stopping of all manipulators in their current position or a 
standstill [5]. In most cases the following applies: the faster this happens, the lesser the 
danger that arises for the robot and its environment. Exceptions to this are tools and 
manipulators such as hands and grabbers that can apply pressure. Stopping the actuators 
could result in a pressure that can lead to injuries and damage. If a robot is used for 
complex activities, injuries and damage could occur that are not directly caused by the 
motion of the robot, but by the consequences of its actions. For example fires may be 
started if an ironing robot suddenly stopped moving or if hazardous goods were being 
transported by a mobile robot [64]. 

In [64, 65], a safety-orientated architecture for robot control systems is presented that 
contains a safety layer. This is intended to always transfer the robot to a safe state. The 
safe states depend on the functions the robots are to fulfill. These can vary greatly and 
therefore in [64, 65] safety policies are suggested that contain a hierarchical rule structure 
that enables the safe operation of a robot. It is conceivable that a robot can find an 
unexpected solution—depending on its degree of autonomy and its inherent capabilities— 
and this can result in dangerous situations. As described in [9], this can occur with the 
frequently used subsumption architecture. In relation to autonomous vehicles, this means 
that driving decisions can be taken according to different criteria such as traffic law, 
efficient driving style and comfort, but a collision avoidance system that can take action as 
the higher level authority would have to be active at all times. 


23.2.4 Power Station Technology 


Atomic power stations are largely regarded as a particular risk, as faults can lead to 
significant environmental damage. The control and regulation systems used there must 
therefore fulfill the highest safety requirements in order to enable operation even after 
natural catastrophes, terror attacks or internal technical faults. As immediate shut-down is 
not possible with atomic power stations, and the combustion elements remain active and 
require cooling even after their deployment in the reactor, many redundant systems are 
required, particularly for cooling. 

The safety of an atomic power station largely depends on the complete and fault-free 
specification and development of the control and monitoring systems. Integrating the 
entirety of the possible situations and events plays an important role, as it is especially 
chain reactions and multiple faults that can lead to hazards. For example, the Fukushima 
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Daiichi atomic power station in Fukushima, Japan was in a fail-safe condition after the 
earthquake and all safety systems were correctly automatically activated. However, after 
the tsunami wave hit, parts of the redundant safety systems were damaged, in particular 
the emergency power units. With hindsight, we can say that the error was not in the failure 
of the safety functions, but instead lay in the incorrect specifications [63]. 

Therefore, for autonomous vehicles it can be said that the numerous events and 
combinations of events and error sources must be taken into account in the specifications 
stage. Possibly this will require a standardization of the requirements, comparable with 
that for atomic power stations. When they are developed, safety plays an essential role in 
the design phase and is the focus of the development process (safety by design, [26]). 


23.3 Safe States in the Use Cases 


One important criterion in the operation of an autonomous vehicle is whether there are 
passengers on board or not. For example, when choosing a parking space, it is not 
necessary to take the safe exit of passengers from the vehicle into account, however the 
safety of other road users cannot be forgotten. In addition comfort plays no role, meaning 
that a different driving style is possible in which comfort can be neglected. However, if 
passengers are on board, the vehicle guidance system must take over the tasks of a human 
driver. This also includes monitoring the passengers, for example if they are wearing their 
safety belts and are sitting on the passengers’ seats or if they are acting in a dangerous 
manner. Collisions with other road users can occur at any time and therefore passive 
safety mechanisms such as safety belts and airbags are also necessary in autonomous 
vehicles. The same applies to the securing of loads, especially hazardous goods. 

The following section will investigate the four use cases defined for the project and 
examine the respective properties of the safe states. 


23.3.1 Use Case 1: Interstate Pilot Using Driver 
for Extended Availability 


By restricting use to freeways, the number of possible and probable situations is lower 
than compared to use in urban traffic. The safety driver is basically present as a fallback 
and is able to take control at any time and whenever he or she regards this as necessary. 
The vehicle is in a safe state in the following situations: 


1. The vehicle is standing still. A stationary vehicle poses no active or immediate danger 
(see [6, 27]). However, the safety of passengers and other road users depends on the 
location of the vehicle: 


— Lane on a freeway: Due to the presence of a safety driver, continuing the journey 
with manual control is very probably possible. If continuing the journey with 
manual control is no longer possible, a stationary vehicle on a lane on a freeway 
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can become a dangerous situation as defined in error codes F5 and F6 in [6] (see 
Table 23.1). On the one hand the vehicle could be overlooked or seen too late, on 
the other hand because the passengers may have to leave the vehicle. Another 
danger can arise if the automated vehicle blocks a path for emergency vehicles in a 
traffic jam. If driving under manual control is no longer possible, the safety driver is 
obliged to secure the vehicle in accordance with the pertinent legal requirements, 
e.g. according to §15 StVO (German highway code) [11]. 

— Shoulders on a freeway or the curbside of a freeway where there is no shoulder, 
parking lot emergency stop bay or other similar location: If an automated vehicle is 
stranded on the shoulder of a freeway, at the curbside or another similar location, it 
may be possible that the safety driver can continue driving under manual control or 
he needs to secure the vehicle in accordance with the pertinent legal requirements 
(see error codes F2, F3 and F4 in [6]). 


2. The vehicle drives on a lane at either prescribed distance or at a greater distance due to 


the vehicle’s performance to other road users and at least at the minimum prescribed 
speed, respectively the highest permitted speed or the highest possible speed the 
performance of the vehicle permits. The vehicle is aware of its own performance and 
can therefore detect the limits of the system independently. 


. The vehicle guidance system reacts with an action (see Sect. 23.5) to an event (see 


Sect. 23.4) to reduce the current risk. In this way a safe state should be attained or 
maintained—for example, by handing over control to the safety driver. 


23.3.2 Use Case 2: Autonomous Valet Parking 


In this use case the maximum speed of the vehicle is only low [approx. 30 km/h (approx. 
19 mph)]. This means that the resulting energy that would be required to brake in the 
event of an emergency is considerably lower than the 50 km/h (approx. 31 mph) that is 
permitted in urban areas in Germany. Transferring control to a safety driver is not possible 
in this use case as the vehicle can be operated without a driver. The safety of passengers 
plays no role as no passengers are on board when the vehicle is driving. The intended 
route must be planned so that the vehicle does not drive on any roads that the vehicle does 
not have command of, for example streets with level crossings. 


— 


The vehicle is in a safe operational state in the following situations: 


. The vehicle is at a standstill: The location of the stopped vehicle is relevant as the 


vehicle could be a dangerous obstacle for other vehicles and block emergency vehicles 
and emergency escape paths. Securing the stopped vehicle is more difficult because no 
human is on board to take over this task. It would appear that only the lighting on the 
vehicle can be used to secure it. In many countries there are special regulations on 
securing broken-down vehicles, for example a warning triangle that has to be set up 
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several meters behind the vehicle. It is hard to imagine that this could be performed by 
an autonomous vehicle. Therefore, one or more persons must be responsible for this. 
The vehicle must either be constantly monitored or request help independently in the 
event that it is forced to stop. 

2. The vehicle is driving on a lane on the road as described in use case 1. However it is 
not possible to transfer control to a safety driver as there is none on board. There is a 
possibility of stopping the vehicle and attaining a safe state in this way. It is also 
conceivable that in the event of a fault, control of the vehicle is transferred to a remote 
operator who then drives the vehicle to a safe location by means of remote control. 

3. The vehicle drives through a crossing or roundabout or turns off. If the vehicle has 
command of the situation and the traffic priority rules applicable to the situation, these 
maneuvers are safe. If the vehicle reaches the limits of the system, it can continue 
driving at a reduced speed while signaling to the other road users. 

4. The vehicle is on a parking lot. The low relative speeds and the comparatively low 
levels of traffic mean that the requirements are lower here and the operating risk is also 
lower. 


The greatest challenge is the lack of a safety driver. In the case of events that increase 
the risk, it is not possible to transfer control to a safety driver and a standstill can have 
hidden risks in many situations as the vehicle cannot be moved immediately under manual 
control. One solution could be the remote operator. This requires a communications 
channel to the vehicle for reporting problems and for the remote control of the vehicle. If 
stopping is required, this must be signaled accordingly to the other road users. Securing 
the vehicle by the safety driver is not possible in this case. 

Blocking emergency vehicle access and emergency escape paths on single-lane roads 
and access points for emergency vehicles in front of buildings and other facilities is a 
special case. Blockages can mean the emergency rescue actions are delayed or compli- 
cated. On the one hand this is illegal, on the other it is a major ethical consideration. The 
author is not aware of any investigations that show the frequency that such situations 
occur. Therefore it is not possible to state whether this case needs to be explicitly taken 
into consideration or not. Non-automated vehicles can also break down, however it is 
simpler for the driver of the vehicle to drive or push the vehicle out of the way in a quick 
and uncomplicated manner. 


23.3.3 Use Case 3: Full Automation Using Driver 
for Extended Availability 


The safety and risks of this use case are very similar to a combination of use cases 1 and 2. 
The presence of a safety driver means it is possible to hand over control. The driver can 
also secure the vehicle should it break down. 
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The necessary driving maneuvers and situations are the same as this in use cases | and 
2. In addition, the vehicle is also used on interstate connections. The maximum speed in 
this use case is restricted to 240 km/h (approx. 149 mph). This means that practically 
every speed is feasible, however the maximum speed must always be selected so that it is 
within the performance capability of the vehicle guidance system and the risk is corre- 
spondingly reduced. 

In terms of the safe state, the same conditions apply as in use cases 1 and 2. 


23.3.4 Use Case 4: Vehicle on Demand 


In terms of (safety) technology, this use case is the most challenging. The vehicle must be 
capable of handling every situation that a human might have to handle. The risk has to lie 
below a threshold of risk that is reasonable for the passengers and other road users. Both 
driving maneuvers and the conditions for the safe state can be taken from use cases 1, 2 
and 3, taking into account that there is no safety driver. 

The vehicle is in a safe state in the following conditions: 


1. The vehicle is standing still as in use cases 1, 2 and 3. In each situation the vehicle 
requires external help. In addition to potential passengers, other persons are involved 
who have to be informed of the state of the vehicle and respond to vehicle problems. 

2. The vehicle is driving on a traffic lane as in use cases 1, 2 and 3. While driving, the 
vehicle must be independently capable of maintaining or attaining a safe state. 


Due to availability on demand and the universal usability, the vehicle on demand must 
be capable of handling all traffic situations. The safety-relevant events that require a 
reaction from the vehicle are examined in greater detail in the next section. 


23.3.5 Summary 


Examining the four use cases has shown that the greatest challenges for the safe state are 
posed by high relative speeds, the lack of a safety driver and blocking of emergency 
vehicle access routes and emergency escape paths. Examining these aspects allows the 
safety requirements for the vehicle to be derived: 


— An autonomous vehicle must be aware of its current performance capabilities. 

— An autonomous vehicle must be aware of its current functional limits in relation to the 
current situation. 

— An autonomous vehicle must always be operated in a condition in which the level of 
risk is reasonable for the passengers and other road users. 

— A vehicle that is standing on the shoulder or by the curbside and is not blocking traffic 
is in a safe state. 
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— A vehicle that is standing on a traffic lane is only in a safe state if all of the following 
conditions are met: 


e The relative speed to other road users is below a maximum still to be defined. 

e The stationary vehicle is not blocking emergency vehicle access routes or emer- 
gency escape paths. 

e A safety driver or remote operator can remove the vehicle from this location within 
a short time. 

e A safety driver can secure the vehicle. 


— A vehicle moving with a high level of risk or one that has come to a standstill at a 
dangerous location must be capable of sending an emergency signal and requesting 
help. 


23.4 Safety-Relevant Events 


Various events can occur in road traffic that affect the risk in the current situation and in 
the future development of the situation. On the one hand, technical defects and faults in 
the vehicle guidance system reduce its performance capacity and on the other hand 
changes to environmental conditions, situations that overtax the vehicle guidance system, 
incorrect behavior of other road users and acts of force majeure all increase the require- 
ments of the vehicle guidance system. In particular a combination of reduced capabilities 
and the increased demands can lead to higher levels of risk. 

Defects and technical faults on the vehicle and in the vehicle guidance system can 
occur suddenly and are therefore very difficult to foresee. In addition to mechanical 
defects on the vehicle, defects and development errors in the vehicle guidance system can 
result in a reduced performance capacity (see [16]). Adverse light and weather conditions 
increase the requirements of the durability of the sensors used to detect the surroundings. 
In addition, adverse weather conditions lead to worse road conditions. These directly 
affect driving dynamics. Due to the complexity of road traffic and the endless quantity of 
possible situations, it is probable that not all situations will be taken into account when 
developing a vehicle guidance system. If the vehicle encounters a situation that cannot be 
resolved with the existing software, this has a direct influence on the risk level. 

Recognizing the ability of the vehicle and the limits of the system is a great challenge 
in such situations. The behavior of other road users does not always conform to the rules 
and it may occur that they behave in a dangerous manner. In some situations, operation of 
an automated vehicle can never be safe because other road users act in a dangerous 
manner. It is conceivable that this may even occur deliberately if an automated vehicle is 
recognized as such. Force majeure can also pose a higher risk to operation, for example 
due to earthquakes or flash flooding or solar bursts that result in interference to the 
systems used such as a global satellite navigation system or vehicle-to-vehicle 
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communication [12]. Such events are not taken into consideration when developing 
driving assistance systems in accordance with ISO 26262 [30]. How they will be handled 
in autonomous vehicles remains open [61]. 


23.5 Measures for Reducing Risk Levels 


Assuming that an autonomous vehicle is always to be operated with an acceptable level of 
risk and at the same time should have as wide a functional scope as possible, actions are to 
be performed as a reaction to safety-relevant events that reduce the risk to an acceptable 
level or retain this level and simultaneously enable a higher scope of functionality. A re- 
duction of driving speed, an increase in distance to the vehicles in the vicinity, 
safety-optimized planning of driving maneuvers, prohibition of certain driving maneuvers, 
and the execution of safety maneuvers are all possible. The underlying principle of 
graceful degradation comes from the field of biology and was presented in [40]. In [68], 
among other things, there is an overview of the applications of graceful degradation in 
aerospace technology, power station technology and other research areas. If errors occur 
in one system or if resources are limited, the vital processes are maintained and other less 
important processes are scaled back or ended. For example, if the field of vision is 
restricted, the speed of the vehicle can be reduced. However, in certain conditions, even 
the execution of these actions cannot reduce the risk to an acceptable level, meaning that 
stopping the vehicle becomes necessary [25, 46], or if this is too risky, leaving the traffic 
flow. 

With graceful degradation, it is not only necessary to attain or maintain a safe state but 
also to improve performance by using mechanisms for self-repair and reconfiguration. In 
technical systems restarting components is a widely-used measure for restoring perfor- 
mance [22, 44]. Restarting needs time and, depending on the system structure, it can occur 
that restarting a component also means restarting or at least re-initialization of other 
components. Therefore safety-critical components often have (diverse) redundant designs 
(see [3, 28]). 

In addition to redundancy there is also the possibility of restoring functionality for 
individual components. Sensors and actuators can be re-calibrated to improve their 
measured values or set-points can be implemented depending on the current situation. 
Reconfiguration mechanisms can be used for the overall system that enable safe operation 
even after risk-increasing events [33]. 

Recognizing risky situations is a challenge. External events must be detected and 
correctly interpreted by the environmental monitoring system. Technical faults on the 
vehicle and in the vehicle guidance system must also be detected. A driver uses his or her 
senses to observe warning and monitoring lamps and notices changes in the vehicle, for 
example due to technical defects. An autonomous vehicle must therefore integrate sensors 
and functions that detect faults and errors and determine the future performance level and 
possible scope of function on the basis of the severity of these faults and errors. The 
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complexity to be expected of a vehicle with a vehicle guidance system will lead to a large 
number of measured values. As a result, a self-representation of the vehicle will be created 
that will be used to create an evaluation of the current risk that depends on the situation 
and the performance capability. The so-called safety actions are performed on the basis of 
this evaluation [46]. 


23.6 Anticipation of Degradation Situations 


Due to the highly dynamic nature of road traffic and the properties of electric and elec- 
tronic systems, safety-relevant events can occur in a fraction of a second and therefore 
require a fast response from the system. However, it is better if situations in which high 
levels of risk are present can be foreseen or at least taken into consideration when 
planning driving maneuvers. Anticipatory driving by humans can be implemented in an 
even more wide-ranging manner in a vehicle guidance system as the monitoring and 
application of numerous measured values is performed directly from the vehicle. 

All of the collected measured value data must be monitored and stored to predict how 
situations will develop. The broad scope of the data analysis could allow incipient errors 
to be detected. Even detecting difficulties a few tenths of a second before the event can 
lead to a safer reaction. A necessary braking maneuver that has been detected and trig- 
gered 0.3 s earlier can shorten the stopping distance by 4.2 m at a speed of 50 km/h 
(approx. 31 mph). 

Communications with the infrastructure and other vehicles yields further potential for 
increasing safety. The sooner information on hazards is available, for example road 
surface damage, dirt and ice, traffic jams ahead or emergency brake maneuvers of vehicles 
ahead on the road, the sooner a response to these can be initiated. 


23.7 Dilemmas 


In some cases, a chain of events can lead to a situation that cannot be resolved without 
personal injuries. When faced with a dilemma, an automated vehicle must select a possible 
course of action, which even though it will result in personal injuries, will cause the 
minimum amount of damage. Material damage and road traffic law infringements are also 
possible, however these have lower priority. The number of passengers on board and the 
type and dynamics of other road users must be taken into account in the evaluation of 
possible uncertainties. Communication with other road users is particularly important here 
and can help to resolve such situations with the minimum amount of personal injuries.° 


55 The DFG priority program “Kooperativ interagierende Fahrzeuge” [Cooperatively Interactive 
Vehicles] will research this field in the coming years: http://www.dfg.de/foerderung/info_ 
wissenschaft/info_wissenschaft_14_34/. 
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A detailed ethical discussion of dilemmas can be found in Chap. 4 of this book. Therefore 
the following section will solely focus on the technical aspects of dilemma situations. 
Figure 23.1 shows two situations. The first can be resolved without a collision. The 
second can lead to a dilemma. At the start of the first situation, the vehicle is driving on a 
road lane and other vehicles are parked by the side of the road. Unexpectedly a person, 
who is barely discernible, steps between the parked cars and onto the road. The vehicle 
can respond in several different ways to avoid a collision with the pedestrian. Option 1: 
The vehicle can brake and stop before hitting the pedestrian. Option 2: The vehicle can 
switch to the neighboring road lane and thus avoid a collision. However, this requires 
crossing a continuous line between the road lanes. This would infringe road traffic law 
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Fig. 23.1 Example of two situations that could cause a dilemma. Image rights: Copyright off the 
Author 
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In the second situation a vehicle is driving in the oncoming direction on the second 
road lane. If one assumes that a braking maneuver will no longer prevent a collision with 
the pedestrian, the autonomous vehicle is facing a dilemma: 

Colliding with the pedestrian could result in serious injuries to the pedestrian (option 2). 
Switching to the neighboring lane will result in a collision with the oncoming vehicle and 
possibly also result in injuries to the pedestrian (option 3). A collision with the parked 
vehicles to reduce the vehicle’s own speed is also feasible (option 4), however it would 
remain highly uncertain as to whether the pedestrian would emerge uninjured from the 
situation. In such situations the decision-taking software within the vehicle guidance 
system will have to be programmed with ethical principles. 

Vehicle-to-vehicle communication between the autonomous and oncoming vehicle 
could solve at least this problem. The two vehicles could find a solution together. The 
oncoming vehicle could switch to the edge of the lane so that the autonomous vehicle can 
pass between the oncoming vehicle and the pedestrian without a collision occurring 
(option 5). Both vehicles would infringe road traffic law in this situation as both must 
cross a continuous line. 

However, operation without communications with other road users and the infras- 
tructure must also be possible as it is unlikely that these communication options will be 
available everywhere and for all road users. 

Vehicle guidance must therefore be possible with the on-board sensors. This on-board 
autonomous operation (see [36]) makes the highest requirements of the vehicle guidance 
system on the one hand and on the other hand is also currently the only possible option for 
use in road traffic. This restricts options, especially in situations involving danger and 
dilemmas and increases the uncertainty in perceiving situations. Signalization to other 
road users is only possible in an optical and acoustic manner. 


23.8 Summary 


In the current state of development of driving assistance systems and related research and 
development areas, there are a wide variety of methods that could and possibly must be 
used in the development of autonomous vehicles. The wide range of technology means 
that these systems affect different areas of the development process and the system to be 
developed and also that they can contribute to the safety of autonomous vehicles. 

First a metric must be found with which the operating risk of autonomous vehicles can 
be evaluated and then a generally acceptable risk threshold must be defined. The proce- 
dure used in power station development for determining the safety requirements and 
integrating functional safety in the overall system could be useful in this area. 

In terms of the functional safety of the regulation of actuators, examples form aero- 
nautics and aerospace and partially rail travel can be used in the current research and 
development of vehicle technology. Multiple, diverse redundancy is one of the most 
promising means. The same applies for software components for situation analysis, 
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decision-making and motion planning. Until now only the field of robotics has been faced 
with similarly complex situations. However, the level of risk there is mostly lower. 

One of the biggest challenges is the reliability and dependability of environment 
perception systems that also include self-perception and situation perception. Due to the 
infinite quantity of possible situations, as far as the author is aware, it has not yet been 
possible to implement complex applications—as described in the use cases—in a safe 
manner. This will also require hardware, software and functional redundancies, for 
example in the composition of the sensors for perceiving the immediate environment. 

A safety driver is still required in research projects for autonomous vehicles. This 
person monitors the system and can either take action directly or use remote emergency 
stop functions or an emergency stop switch. The research projects considered currently 
focus heavily on functions and less on their functional safety. 

The safety of autonomous vehicles is one of the basic challenges of future research. 
The development of the technology not only requires the resolution of technical problems, 
but also legal and social problems. A large proportion of these will be discussed and 
examined in the later chapters of this book. 
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Abstract 


24 


Cars have for a long time been a symbol for the freedom and autonomy of their users. 
Now autonomous driving raises the question how the data flows related to autonomous 
driving influence the privacy of these cars’ users. Therefore this chapter discusses five 
guiding questions on autonomous driving, data flows, and the privacy impact of 
vehicles interacting with other entities: (1) Which “new” or additional data are being 
collected and processed due to autonomous driving and which consequences result 
from those “new” or additional data being collected and processed? (Sect. 24.2); 
(2) Are certain types of data special and do they cause special hindrances? (Sect. 24.3); 
(3) What is required from the perspective of privacy? (Sect. 24.4); (4) When building 
architectures, what needs to be kept in mind to avoid creating difficult or even 
unsolvable privacy problems? (Sect. 24.5); (5) What needs to be considered in the long 
term? (Sect. 24.6). The questions will be discussed relating as much as possible to the 
case studies that were introduced at the beginning of this book. Sect. 24.7 concludes 
this text including an analysis whether more autonomy of driving vehicles leads to 
more privacy problems. 
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24.1 Introduction: Cars, Freedom, and Privacy 


Cars have for a long time been a symbol for the freedom and autonomy of their users, be it 
drivers or passengers: Car drivers can decide on their own, where to drive, which route to 
choose and often even how fast to travel (or at least when to take a break), and they don’t 
need to report this to anybody. Many pieces of art reflect the opportunity for freedom and 
escape from (often undue) control that cars offer to their users. Some of the most 
impressive examples may be episodes 3, 4, 6, and 7 of the 1947 movie “In those days” [1], 
which describe the more or less successful car journeys of several people oppressed by the 
German Nazi regime between 1933 and 1945; other examples can be mentioned also 
(Chap. 3). At the same time, a car offers its driver and holder a protected sphere of 
privacy: People from outside usually don’t hear what is communicated in a car and they 
cannot easily take a seat and join the conversation. “My car is my castle” is not as popular 
as “my home is my castle”; still many people see their car as the extension of their home; 
correspondingly many household goods and activities can be viewed in a car ([2], para- 
graph 2). 

If one takes this perspective, autonomous cars could be just an extension of the tra- 
ditional concepts of freedom, autonomy, and privacy for their drivers and users. However, 
“autonomous driving” in first instance makes the driving more autonomous from the 
drivers. At the same time, it relies much more on interaction with the outside world than a 
human-driven car. Autonomous cars sense their environment and often even communicate 
with that environment, e.g. cars nearby. Beyond that exchange with near-by entities, there 
are plans to control and synchronize cars with traffic centers to optimize their behavior, 
e.g. their choice of a route. Like any other centralized entity collecting data, this raises 
privacy concerns, and motivates an analysis of the data flows and the corresponding 
privacy impact. The situation is more critical if one considers that cars not only can collect 
a lot of data on their users and the environment, but also store them for a long time and 
then communicate them to other entities. 

Therefore this chapter follows five guiding questions on autonomous driving, data 
flows, and the privacy impact of vehicles interacting with other entities: 


1. Which “new” or additional data are being collected and processed due to autonomous 
driving, and which consequences result from those “new” or additional data being 
collected and processed? (Sect. 24.2) 

2. Are certain types of data special and do they cause special hindrances? (Sect. 24.3) 

. What is required from the perspective of privacy? (Sect. 24.4) 

4. When building architectures, what needs to be kept in mind to avoid creating difficult 
or even unsolvable privacy problems? (Sect. 24.5) 

5. What needs to be considered in the long term? (Sect. 24.6). 


W 


The questions will be discussed relating as much as possible to the use cases that were 
introduced at the beginning of this book. Section 24.7 concludes this chapter. 
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24.2 Additional Data Collected and Processed due 
to Autonomous Driving 


To assess the opportunities and risks associated with collecting additional data and 
making it usable, it is useful to first try to identify those data. This will be done along the 
four use cases defined in Chap. 2, but first a short overview on data that is being collected 
or may be collected in a non-autonomous car will be given. 


24.2.1 Personal Data Collected and Potentially Transmitted 
in Today’s Networked Cars 


While the analysis in this chapter will concentrate on “new” or additional data, it should 
be mentioned here, that quite a few sensitive personal data are already collected in today’s 
cars and sometimes even transmitted. Some examples are 


e All types of location data and navigational data: Typical data are destination, travel 
time, travel habits (“every weekend to Stuttgart”) and preferences for routing (scenic 
vs. fast vs. ecologically friendly vs. on the edge of legality). Especially when a car is 
tracked by a dispatching system, a theft control system, a car insurance system, or a 
road pricing system, a lot of information is collected about its whereabouts and in 
many cases transferred to the related central entities. Some of these systems store data 
in decentralized fashion due to their sensitivity, but others don’t. An example that 
became quite prominent recently is the new European eCall system [3-5]: eCall is 
activated automatically as soon as in-vehicle sensors detect a serious crash. Once set 
off, the system dials the European emergency number 112, establishes a telephone link 
to an emergency call center and sends details of the accident to the rescue services, 
including the time of incident, the accurate position of the crashed vehicle and the 
direction of travel (most important on motorways and in tunnels). An eCall can also be 
triggered manually by pushing a button in the car, for example by a witness to a 
serious accident. 

e Data on driving dynamics: This type of data, for instance on acceleration, gives 
information on the behavior of the car but also on the behavior of the driver, such as 
the driving style (e.g. calm vs. aggressive vs. fast vs. on the edge of legality). 

e Data on driving behavior: These data can be derived from location data over time. For 
example, comparing the location of a car on a highway with the location 15 min before 
may tell about the average speed of the car and whether a speed limit was violated or 
possibly violated. 

e The environment: The car may be collecting data from the environment to document 
the ride or specific traffic situations in case such documentation would be considered 
helpful later. Examples include dashboard cameras to document and maybe transmit 
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what is happening in front of the car. Data from the environment may well be other 
people’s personal data, e.g. number plates of other vehicles or faces of people. 


This rough overview also raises the question: What kinds of data are actually personal? 
Some of the data listed may not seem to be “personal”. However, experience over years of 
initiatives aimed at privacy protection has shown that there are no guarantees that data 
cannot be related to persons and cannot be misused. One consequence of this lesson is that 
“personally identifiable information (PII)” is nowadays not only the information that 
directly identifies a person, but “any information that (a) can be used to identify the PII 
principal to whom such information relates, or (b) is or might be directly or indirectly 
linked to a PII principal” ([8], clause 2.9)." The PII principal ([8], clause 2.11) is then the 
individual whose data are being processed. In our cases, PII principals may include 
drivers, passengers, or car owners, but also passersby who are sensed and can be identified 
in any way. 

Still, the fact remains that the practical sensitivity of data at a certain point in time 
depends a lot on context, e.g. the location information of a car may be more sensitive if the 
car is parked near a red-light district. More examples will be seen in the discussion of the 
use cases of autonomous driving and the related interests of the parties involved. More- 
over, analyzing the cases helps to illustrate new situations and the respective issues. 


24.2.2 Personal Data Collected in Autonomous Cars 


This section discusses the data collection in autonomous cars along the four cases as 
introduced in the beginning of this book (Chap. 2). 


24.2.2.1 Use Case 1: Interstate Pilot Using Driver for Extended 
Availability 

The driving robot takes over the driving task, but only on interstates or interstate-like 

expressways. During autonomous journeys, drivers become passengers who can take their 

hands off the steering wheel and feet off the pedals and pursue other activities. The driving 

robot coordinates a safe handover to the driver and may even stop the car at a safe place if 

needed. 


'The relation between data and information is too subtle and too complex to be sufficiently 
explained within the limits of this chapter. All the same, considering data and information as roughly 
equivalent should suffice for the purpose of this chapter. Using only one term would put the paper at 
odds with some of the referenced literature. 
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The new and additional data the car can collect and learn in this case are data on: 


e Driver capabilities, e.g. whether the driver is able to take back control from the robot 
or not, and how much time such a take-back-operation takes: Both types of data may 
be of interest as up-to-date data for immediate reaction but also as a basis for longi- 
tudinal evaluations. 

e Driving behavior: On top of other data on driving behavior that are already available 
nowadays, this case enables the collection of additional data, i.e. under which cir- 
cumstances the driver delegates control and/or demands it back. 

e The environment: Additional data from the environment can be collected to pursue the 
autonomous ride. Also, documenting the ride or specific traffic situations may be 
considered helpful to handle potential conflicts. As in Sect. 24.2.1, data from the 
environment may well be the personal data of other people, e.g. number plates of 
vehicles or people’s faces. So environmental data contain a mix of personal data of 
several people, which makes them especially delicate. 


Following the discussion on the legal and liability implications of autonomous driving 
(see the part of this book on law and liability (Part V) one can indeed assume that there 
will be an interest in collecting data to document potential accidents and investigate what 
behavior of the car, the robot, the driver, or other parties may have caused the accidents. 
This would accord with other cases of law enforcement agencies having a large “appetite” 
for data that may become available through the computerization of an activity, as com- 
puterized activities are usually easy to log in computerized logs. 


24.2.2.2 Use Case 2: Autonomous Valet Parking 

The driving robot parks the vehicle at a nearby or remote location after the users have 
exited and cargo has been unloaded. The driving robot drives the vehicle from the parking 
location to a desired destination. The driving robot re-parks the vehicle. The driver saves 
the time of finding a parking spot as well as of walking to/from a remote parking spot. In 
addition, access to the vehicle is eased (spatially and temporally). Additional parking 
space is used more efficiently and search for parking is arranged more efficiently. 


The new and additional data the car can collect and learn in this case are data on: 


e The duration of a stay: How much time do users spend at their destination? 

e The area of interest: Where do the users spend more or less time? 

e Times of travel and duration of gaps in between: When do users spend more or less 
time leaving the car alone (e.g. always at Saturday night there is a ride to somewhere 
and then a long break of more than 8 h)? 

e Under which circumstances is the car left alone? 
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e Visiting habits: How often does the user go where? For example, “every weekend to a 
certain supermarket, bar, or discotheque.” 

e The environment: These data may in principle be the same as in Use Case 1, but 
depending on the environment, there may be different data. Driving through a parking 
lot the car may “catch” more number plates than on a highway, but fewer people (and 
faces) in the cars. However, on the way to the parking lot there may be more 
pedestrians, e.g. crossing the streets, so more faces to recognize. 


As there is no direct interaction between the driver and the car, no data on driving 
behavior are collected. 


24.2.2.3 Use Case 3: Full Automation Using Driver for Extended 
Availability 

Use Case 3 is similar to Use Case 1, as in both cases the driving robot performs the 
driving task with drivers just being passengers who can take their hands off the steering 
wheel and their feet off the pedals and pursue other activities. However, in Use Case 3 the 
driver can delegate the driving task to the driving robot in many permitted areas, not just 
expressways. So the new and additional data the car can collect and learn are basically the 
same as in Use Case 1, but there may be more options for the driver to delegate and take 
back control. This can lead to more data being available on driver behavior, especially in 
circumstances where the driver delegates control and/or takes it back. Similarly to Use 
Case 2, the data on the environment may be richer and more sensitive than the data 
collected on a highway described in Use Case 1. 


24.2.2.4 Use Case 4: Vehicle on Demand 

The driving robot drives the vehicle autonomously in all scenarios with occupants and/or 
cargo, but also completely without any payload. The driving robot makes the vehicle 
available at any requested location. Passengers use the travel time completely indepen- 
dently for activities other than performing the driving task. The cabin design is completely 
free of any requirements for any driver workplace whatsoever, but it may have a camera 
directed at the passenger space. 

While this case is the most demanding from the perspective of autonomous driving, 
there may be less additional data collected than in Use Case 3. In particular, there is no 
additional data collected on driving behavior, as there is no driver in the loop anymore. 
The additional data collected are: 


e Travel behavior (e.g., when do passengers want to take breaks?) 

e General behavior (or misbehavior) of all passengers in the car 

e Data collected on the environment, e.g. to document an accident and what may have 
caused it (if data on passengers are considered useful for accident documentation). 
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24.2.3 Consequences for Control Over Data and Misuse Resulting 
from Data Storage 


In principle, the storage of any kind of data opens possibilities for any kind of processing 
that would not exist without that storage. While this seems to be a theoretical triviality, the 
practical consequences of storing data are that they can be used and misused later, maybe 
under circumstances of which the user was not originally aware. This implies a 
longer-term responsibility for these data. The responsibility has to lie with the body that 
can control the data and make decisions about their usage. 

If one can assume that the data stored in a car are under the sole control of the car’s 
owner or driver, then determining responsibility for these data may be relatively easy. 
Otherwise, the responsibility for storage and any kind of misuse would expand to the body 
that controls the storage or transfer or both. This only applies, however, if the data can 
leave the car and the domain of its owner without the owner being in control of this data 
transfer. 

There are at least two indications that powerful bodies will ask for data stored in a car 
to be transmitted out of the car: 


1. Law enforcement agencies very often take the approach that data stored for any 
technical or commercial purpose should also be made available for law enforcement 
purposes. Lawmakers have often followed this position. The example closest to cars 
and location data is that of mobile phone communication. From the beginning of the 
1990s, the GSM standard for cell-based mobile communication has been established 
and the location information of subscribers processed in the networks. Rules were soon 
established to enable law enforcement agencies to access all types of data in the GSM 
networks, including location data: an example is the German Fern- 
meldeüberwachungsverordnung [6], which was established as early as 1995. 

2. Internet enterprises such as Google are inspired and driven by connectivity and 
transmitting data. An example is a statement of Jared Cohen, Director of Google Ideas 
and Eric Schmidt, Executive Chairman of Google in the conclusions of their joint book 
“The New Digital Age” [7], p. 254: “Attempts to contain the spread of connectivity or 
curtail people’s access will always fail over a long enough period of time-information, 
like water, will always find its way through.” 


Not everything that these powerful organizations have been asking for has happened, 
but the examples give an impression of the challenges accompanying data storage, even in 
a contained fashion. 


24.2.4 Consequences from Data Transfer to Third Parties 


Data being transferred to entities outside of the domain of the car owner or driver (third 
parties) can enable those entities to pursue their interests. These interests may or may not 
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conform to the interests of the parties identified by the data (also called data subjects), 
typically the driver or the owner of the car. This section will give examples of the 
following third parties: vehicle manufacturers, insurance services, fleet operators, 
government-authorized parties, peer ad-hoc networks, e.g. other traffic entities or other 
autonomous vehicles, and traffic centers. This sequence of sections follows the rising 
complexity in the setting of the third party entities. 


24.2.4.1 Vehicle Manufacturers 

Vehicle manufacturers may be interested in documenting vehicle behavior, e.g. to learn 
about the vehicle’s behavior in extreme situations and about the quality of their (often 
very complex) software, and to improve the systems. These data are similar to the kind of 
data that manufacturers and operators of telecommunication systems collect for quality 
assurance and maintenance purposes. At the same time, these data also deliver sensitive 
information about the driver, e.g. the typical driving speed and the number of emergency 
brakes or missed handovers from the driving robot in Use Cases 1 and 3. 


24.2.4.2 Insurance Services 

Insurance services are often interested in more information about their customers to assess 
the level of risk associated with them or gain other customer insight. Depending on the 
type of insurance, different information can be of interest, e.g. the insurance risk for an 
accident can be derived from driving behavior (risk averse or less risk averse driving 
style), and from location information for theft insurance (regions with more or less theft 
risk for the specific vehicle). All cases offer rich data here, Use Cases 1 and 3 more on 
driver behavior, all cases on location information, Use Case 4 also on occupants’ behavior 
and emergency calls. These assessments may be fairer to insurance customers, as they 
award cost-reducing behavior, but they put users under more surveillance without a clear 
description of the related risks and opportunities. Often insurance services make decisions 
based on scoring systems or details unknown to customers, as these details are considered 
“trade secrets” the insurance companies wish kept confidential to protect themselves in a 
competitive market. Customers may then be surprised about decisions, e.g. the denial of 
an upgraded contract or a fee raise. 


24.2.4.3 Fleet Operators 

Fleet operators such as rental car companies are in a situation similar to that of insurance 
companies. To raise their commercial success, they try to assess the risk associated with 
handing out a car to a certain customer and to consider the results of their assessments for 
their pricing. Therefore the consequences for customers are also similar to those in the 
case of insurances, e.g. with regard to (non)-extensions of contracts or fee rises. Also for 
this scenario, all use cases offer data. A major difference to the case of insurance com- 
panies is the fact that fleet operators usually own the cars, so they have more control over 
the cars than an insurance company has over an insured car. This difference is important 
for any concept of a “private data vault” to store sensitive data of rental customers or 
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drivers (see Sect. 24.5). In the fleet-operator scenario, such a “private data vault” would 
either need to be specially installed within the car to protect it from access by the fleet 
operator or it would need to be brought along by the rental customer or driver. 


24.2.4.4 Commercial Location-Based Services 

Advertisers are interested in directing the right messages to their respective target groups. 
This may include placing advertisements at the right location, e.g. special offers of shops 
near the next exit, encouraging commuters in a traffic jam to leave the highway and go 
shopping. Also, travelers in a traffic jam on the way to a major airport can be targeted with 
offers from a smaller regional airport (as seen, for instance, on the highway north towards 
San Francisco airport, where flights starting from San Jose have been advertised). 
Advertisers are thus interested in traffic flows (and jams). Moreover, they always like to 
know more details about their target groups, so any kind of behavior that allows con- 
clusions, e.g. on the type of traveler (business, commuting, leisure) will be welcome. 


24.2.4.5 Government-Authorized Parties 

Government-authorized parties such as police forces or intelligence agencies can use the 
data for surveillance to detect behavior they want to sanction or prevent. In the case of the 
traffic police, this can be any kind of behavior deemed unsafe or in violation of traffic 
laws, e.g. difficulties or strange behavior in interaction with the driving robot. Polices 
forces investigating crimes or aiming to prevent crimes as well as intelligence agencies 
may be interested in analyzing navigation and movement data to learn about the social 
networks of travelers, e.g. who may meet whom where. There is also the strong potential 
that the interested government and intelligence agencies have their very own interpretation 
of what they are authorized to do beyond the assurances and guarantees of privacy laws 
and privacy protection. This may especially hold for data on the environment the car 
would be collecting. Having many or all cars collecting data from the environment can be 
considered a specific form of crowd-sourcing. Some municipalities are considering 
crowd-sourcing to collect pollution data. This may collect fewer or no personal data from 
the environment, but conceptually it is not too far from a car spying on its environment. 


24.2.4.6 Peer Ad-Hoc Networks 

Peer ad-hoc networks (e.g. other traffic entities or other autonomous vehicles) can be 
interested in any kind of data used or analyzed by a specific car to optimize path tracking 
and stabilization or which results from the optimization process. This data may help the 
peer ad-hoc networks to assess the road conditions other vehicles are experiencing 
especially at locations that are touched by their own routes. If the data are anonymized and 
stay with the involved peers, the consequences are less severe than data transfer to 
(central) entities aggregating data like the other entities discussed in this chapter. 
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24.2.4.7 Traffic Control Centers 
Traffic control centers’ interests depend a lot on the interests of their operators and owners. 
Control centers aiming for efficient traffic flows, and to mitigate the effects of accidents on 
traffic flows, are interested in any kind of data that help them to assess current and future 
traffic situations: Driving conditions can be derived from environmental information or 
from the assessments of driving behavior as delivered in all cases; potential congestion 
can be derived from travel plans and navigational data. The other aims of these centers 
may include collaborations with other entities to refinance their costs or even deliver a 
profit to their owners or operators. This is helped by the fact that the other entities 
discussed earlier in this section can make use of the data collected by traffic centers. 
The degree to which traffic control centers would be interested in collaborating with 
other entities interested in their data, and offer some reimbursement, may well depend on 
their status and financial situation. A private for-profit control center would need to find 
funding; a public traffic center may be under less pressure here. However, for many recent 
major investments in public infrastructures, there were aims to operate them as 
public-private partnerships to mitigate the lack of public money for investments. This 
holds for toll-fee collection and was also the plan (though not a successful one) for the 
Galileo satellite network. Also, public broadcasting companies are becoming more and 
more dependent on private co-funding, e.g. from advertisements. 


24.3 Are Certain Types of Data Special and Do They Create 
Particular Obstacles? 


It is extremely difficult to predict the potential use of data for legitimate or illegitimate 
purposes, and it has proven impossible to guarantee that no kind of data would be used or 
misused, even in the long run. One reason is that, with today’s connectivity, combining 
data is easy. Data on the agility a driver shows when taking back control from a driving 
robot may look harmless, but if put in relation to the same data 10 years before or hence, 
they can give the impression of driving abilities tending to rise or fall. This may put the 
driver at an unfair disadvantage, e.g. when insurance fees are calculated. Similar scoring 
activities by credit rating agencies have shown to be often very wrong with regard to an 
individual, even if they may have a statistical value. Therefore there are no explicit rules to 
consider certain data special and have special hindrances for their usage. One can get the 
feeling that data allowing conclusions on to be drawn people’s health and/or (political) 
views are especially sensitive, but there are no clear indications that these are always more 
sensitive than data on their financial situation, for example. 

The legal consequence of this difficulty is the principle of asking for the processing of 
each and every piece of data to be authorized, instead of giving general clearances (see 
also the descriptions of “Purpose legitimacy and specification” and “Collection limitation” 
in Sect. 24.4.1). All data thus needs to be checked: Are they absolutely necessary to 
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provide the service for which they have been collected? Was that type of processing 
appropriate? 


24.4 Requirements from the Perspective of Privacy 


This section discusses the requirements from a privacy perspective, starting with an 
introduction of internationally established principles and their relation to the use cases 
(Sect. 24.4.1). Then additional surveillance measures for a “data-protected” usage of the 
additional data are discussed in Sect. 24.4.2, before Sect. 24.4.3 focuses on limiting access 
rights and on encryption. 


24.4.1 Principles 


For any personal data collected and transmitted beyond the domain of the data subject, 
there must be a clear justification with regard to relevant privacy principles and related 
requirements. Privacy principles and requirements depend on the respective national, 
regional and sometimes sector-specific legislation, so a complete analysis would be 
impossible. Fortunately there is now the international standard ISO/IEC 29100 Privacy 
Framework that was completed in 2011 and lists eleven privacy principles [8]. These 
privacy principles were derived from existing principles developed by states, countries 
and international organizations, e.g. the OECD and the EU. The editors came from 
Germany and the USA, and experts from many countries participated intensively in the 
development. One focus of the ISO/IEC 29100 Privacy Framework is the implementation 
of the privacy principles in ICT (Information and Communications Technology) systems; 
another is on developing privacy management systems within organizations’ ICT systems. 
The privacy principles aim at guiding the design, development, and implementation of 
privacy policies and privacy controls. A sketch of related requirements can also be found 
in a recent recommendation of the very influential “Deutscher Verkehrsgerichtstag,” an 
annual conference of legal experts focused on traffic regulation [9]. The eleven principles 
are: 


. Consent and choice 

. Purpose legitimacy and specification 

. Collection limitation 

Data minimization 

. Use, retention and disclosure limitation 
. Accuracy and quality 

. Openness, transparency and notice 

. Individual participation and access 


508 K. Rannenberg 


9. Accountability 
10. Information security 
11. Privacy compliance 


This section will concentrate on explaining the principles considered most important 
and give some examples from the use cases”: 


e Consent and choice: The Consent principle was introduced over time to ensure that PII 
(personally identifiable information) principals can control whether or not their PII is 
being processed except where applicable law specifically allows the processing of PII 
without consent. It is explicitly mentioned that consent needs to be informed consent, 
so PII principals are to be informed about what they agree to, and it also needs to be 
opt-in consent. It turned out that demanding appropriate choice became important to 
avoid users giving de facto consent, as they have no alternative to get the respective 
service. In Use Cases 1, 2 and 3, consent will be needed from the owner, the driver and 
any identified passenger. In Use Case 4, passengers’ and, if applicable, drivers’ con- 
sent is required. The most critical question, however, arises around consent for 
scanned environmental data. For example, private observation cameras are usually not 
allowed when they cover public space and can collect data from people there. For data 
from public observation cameras there are strict rulings that follow the following 
principles. 

e Purpose legitimacy and specification: Adhering to this principle means: ensuring that 
any purposes comply with applicable law and rely on a permissible legal basis; 
communicating any purpose to the PII principal before the information is collected or 
used for a new purpose; using language for this specification which is clear and 
appropriately adapted to the circumstances; and, if applicable, giving sufficient 
explanations for the need to process sensitive PII. A purpose can require a legal basis 
or a specific authorization by a data protection authority or a government authority. If 
the purposes for processing PII do not conform to applicable law, processing should 
not take place. For all use cases this means especially that the purposes need to be 
specified explicitly and in a clear way. This will be a special challenge for the scanning 
of environmental data. 

e Collection limitation: The collection of PII is to be limited within the bounds of 
applicable law and those data that are strictly necessary for the specified purpose(s). In 
our use cases, this applies especially to any data on the behavior of any driver and 
identified passenger. If the purpose is autonomous driving, any data collection will 
need to be justified in relation to autonomous driving (and not any other use, even if, 
for example, it seems commercially attractive). 

e Data minimization: Data minimization is closely linked to collection limitation, but 
refers to strictly minimizing the processing of PII. Data processing procedures and ICT 
systems are to minimize the PII processed and access to it. Default options should, 


ISO/IEC 29100 has more extensive explanations of the principles. 
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wherever possible, not involve the identification of PII principals, reduce the 
observability of their behavior, and limit the linkability of the PII collected with other 
PII (and thereby also the traceability of the PII principal). Moreover, one should delete 
and dispose of PII whenever the purpose for PII processing has expired, there are no 
legal requirements to keep the PII, or whenever it is practical to do so. For all four use 
cases, this principle limits the transfer of any data to any central entities, such as traffic 
control centers: PII that is only needed to manage the situation in and around the 
vehicle shall not leave the vehicle without the PII principal’s permission. Data mini- 
mization also demands the storage of sensed data to be limited, especially when the 
data can easily be recollected when needed again. Last but not least, limiting the 
linkability of the PII collected calls for anonymization and aggregation of any data that 
is not needed for individual cases. 

e Information security: Information security refers to protecting PII with appropriate 
controls at operational, functional and strategic levels to ensure the integrity, confi- 
dentiality and availability of the PII, and protect it against risks such as unauthorized 
access, destruction, use, modification, disclosure or loss throughout the whole of its 
life cycle. Information security spans a wide spectrum from choosing an appropriate 
PII processor to limiting access to PII to those individuals who require such access to 
perform their duties. Sects. 24.4.2 and 24.4.3 describe related measures. 


Data usage beyond that absolutely needed to provide the service for which the data was 
collected requires explicit consent. So for any PII collected and transferred beyond the 
domain of the PII principal, there must be a clear and convincing rationale with regard to 
relevant privacy principles. The rationale must be convincing for the PII principal in terms 
of what is gained and what is given up. The rationale must also be convincing for the 
regulator, who will check whether the PII principal is being misled, e.g. by stating a data 
processing necessity that does not exist when, following the data minimization principle, 
an alternative methodology or technology could be chosen. The regulator will also check, 
whether fundamental rights would be endangered by processing the data; fundamental 
rights cannot simply be given up by users through consent, as they may not understand the 
consequences. A related example would be asking users to store and process their voting 
behavior. 

Any PII that may enable users to be discriminated against according to their beliefs, 
thoughts or actions (e.g. topics of interest and related locations and destinations (e.g. 
towards a political demonstration), also in relation to other people’s locations and desti- 
nations of) is in many practical cases especially critical. 

One example for a reasoning can be found in the landmark decision of the German 
Constitutional Court from 1983 [10], that established the fundamental right of “Infor- 
mational Self-Determination” in Germany and asks to beware of a “chilling effect” on 
citizens’ participation in democratic processes: A person who is uncertain as to whether 
unusual behavior is being taken note of, used, or transferred to others will attempt to avoid 
standing out through such behavior. Persons who assume, for example, that attendance of 
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an assembly or participation in a citizens’ interest group will be officially recorded, and 
that this could expose them to risks, will possibly waive the exercising of their corre- 
sponding fundamental rights. This would not only restrict the possibilities for personal 
development of those individuals but also be detrimental to the public good, as 
self-determination is an elementary prerequisite for the functioning of a free democratic 
society based on the freedom of action and participation of its citizens. 

Similar considerations are especially relevant in countries with unstable political 
governance, where citizens have to fear that a future government may not tolerate 
behavior that would currently be perfectly legal. This may include travelling to a political 
meeting. 

Moreover, the Snowden revelations [11] have shown that there are severe weaknesses 
to be considered in the data security governance of many entities storing PII, especially 
data attractive to intelligence agencies. These developments can be expected to be 
included in future risk analyses and considerations. 


24.4.2 Additional Surveillance Measures for “Data-Protected” 
Usage of Additional Data 


Additional surveillance measures for a “data-protected” usage of the additional data can 
be foreseen. They are motivated, for example, by the ISO/IEC 29100 principle of 
accountability [8]. 

The accountability principle means that the processing of PII entails a duty of care and 
the adoption of concrete and practical measures for its protection. This will apply to any 
party processing PII. The measures are supposed to not only secure the proper processing, 
but also enable and ease supervision by regulatory authorities, e.g. data protection 
commissioners. 

The information security principle (cf. also Sect. 24.4.1) calls, for example, for controls 
at operational, functional and strategic levels to ensure the integrity, confidentiality and 
availability of the PII, and protect it against risks such as unauthorized access, destruction, 
use, modification, disclosure or loss throughout the whole of its life cycle. 

Typical issues of importance are to audit who had or has access to the PII and who 
worked or works with it in which way. Additional surveillance measures will therefore 
apply to any additional entity that may have access to the PII. Experience with auditing 
has shown that it can lead to additional privacy problems, as audit records on processing 
may be used in an even more discriminatory way than the data themselves. An example 
could be an entry in a traffic control center’s audit log that PII on the reaction times of a 
certain driver’s interaction with the driving robot were examined by a task force to 
analyze driving behavior. 

Moreover, additional surveillance measures should not lead to oversurveillance of the 
individuals working with the system, at least in regions where privacy in the workplace is 


24 Opportunities and Risks Associated with Collecting and Making ... 511 


protected. So a fine balance has to be found depending on the relation between customer 
protection and employee protection. 


24.4.3 Limiting Access Rights and Encryption 


Limiting access rights and encryption are typical instruments of information security. 
Limiting access rights is also mentioned under the “Information Security” principle of 
ISO/IEC 29100. It follows the concept of “need-to-know”, limiting access to PII to those 
individuals who require such access to perform their duties, and limiting the access of 
those individuals to only that PII which they require to perform their duties. Access rights 
can be defined by defining exactly which entity can access which PII. This asks for a 
fine-grained specification of the system, and can best be achieved if privacy is already 
considered during the design phase, e.g. when designing which data are collected by the 
vehicle and for which application they are needed. 

Another way to limit access rights is to define that only groups of entities can jointly 
access certain data, e.g. any kind of audit records. This four-eye principle (or n-eye 
principle) helps against unauthorized use of data and can especially apply to audit records 
of system behavior involving PII. One could specify, for example, that these kinds of data 
are only made available to address a defined system failure, and that both the PII principal 
and the interested party, e.g. an authorized repair shop, need to agree on the access. The 
n-eye principle can also be implemented by encryption if parts of keys are distributed 
among the respective stakeholders. 

Encryption is not directly mentioned in ISO/IEC 29100 as its use is sometimes con- 
sidered controversial in some ISO/IEC member states. However, encryption is mentioned 
as an example of a requirement for transmitting medical PII over a public network ([8], 
Clause 4.4.7). It is also being asked for more and more by Privacy Commissioners, who 
have understood its advantages, especially for creating virtual vaults or tunnels to protect 
PII even without the cooperation of the entity storing or transporting the PII. If encryption 
is used, it is important to define clearly who will be allowed to hold the keys for the 
respective encryption and decryption. PII providing clues to an individual’s behavior and 
abilities may need to be protected by an asymmetric encryption system, and then by 
encrypting the PII with the public key of the respective individual. This would ensure that 
the PII can only be decrypted with the corresponding private key of the individual. 


24.5 Architectural Considerations 
Any architectural considerations need to consider the interests of systems’ stakeholders. 


PII stakeholders mentioned in this text so far include drivers, passengers and owners of 
cars. Other stakeholders may be individuals who need to work with the PII, perhaps also 
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bystanders on the street or other traffic participants if they can be identified by the system.” 
It turns out to be useful to consider non-professional users of systems especially, as they 
usually have less opportunity to protect themselves [12]. They are usually also those 
entities that Privacy Commissioners are meant to look after. 

In general, architecture characteristics can be derived from the principles discussed in 
Sect. 24.4.1. The principles of collection limitation, data minimization, and information 
security are especially relevant for architectural considerations. Any architecture that 
allows a service to be provided that collects, uses and spreads less PII not only reduces the 
damaging consequences of any misuse, but also eases the securing of information. 

Three architecture characteristics and elements are especially recommendable: 


1. Decentralized approaches: If PII is not transferred to central entities, such as traffic 
centers, the risk of misuse is reduced. Examples include: 


— If, in any of the cases, a situation can be resolved directly between two vehicles, 
this is better than involving a traffic control center or other external entity. 
Sometimes the issue of the trustworthiness of the information provided by other 
vehicles is brought up. A quick solution seems to be to identify the other vehicle 
individually and to check it against a central registration database, similarly to a 
police car checking registration plates of cars. This may be a nice sales scenario for 
selling directory services, but viewing it as a gain for privacy or security is 
short-sighted. It would transfer an exceptional police activity into a regular activity 
performed by perhaps every vehicle, and so establish a massive surveillance 
infrastructure. Moreover, being able to identify a car precisely does not give any 
guarantee for the information provided by that vehicle. This information may still 
be manipulated and misleading even if a valid identifier is sent by the vehicle 
originating the information. 

— The concept of a user-owned “Private Data Vault” (PDV) to store PII should be 
explored in more detail to enable the storage of sensitive data under the user’s 
control. This PDV could store the PII of the respective individuals and protect it 
against unwanted access, so that access is not possible without those individuals’ 
consent. Especially for drivers using cars used by several drivers, and for rental 
customers or drivers, this would be useful. A PDV could be installed within the 
vehicle (in the special case of vehicles used mainly by a single person) or would 
ideally be brought by the respective driver when using the car. The PDV should use 
appropriate hardware protection for storing the data, and can be the initialization of 
trustworthy data stores. A combination with other personal devices such as mobile 
phones might be possible in future, but first these devices need to become more 
secure and better able to protect themselves, especially against outside approaches 


3This may be a motivation to design the system in such a way that it does not identify bystanders on 
the street or other traffic participants. 
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to read their data. Related concepts exist for road toll charging, see e.g. [13], and 
pay-as-you drive insurance, see e.g. [14]. 

— If data needs to be stored that is not only personal data of the car user, but also of 
other parties, such as environmental data (it may identify other people, but also the 
route the user used), the four-or-n-eye principle should be applied for access 
control. 

— In Use Case 2, traffic control centers or other entities involved in the choice of 
parking spaces should not ask the drivers or passengers for all kinds of priorities for 
a parking space or route, but instead give some options, so that the user or, a local 
system assisting the user, can choose. This reduces the risk of a centralized pro- 
cessing of users’ attitudes with regards to prices and locational preferences. 


2. Anonymization: Information that needs to be collected for a justified purpose does not 
necessarily need to be collected in a way that identifies the respective individual. Even 
information that is collected in a way that identifies individuals may not need to be 
processed further in such a way. This holds especially for any information that is only 
needed in an aggregated form: 


— Traffic and congestion analysis does not need to identify individual cars or even 
drivers. 

— Interaction with peers, e.g. exchanging data for traffic safety with other vehicles, 
does not require identification (see the discussion above under “Decentralized 
approaches”). 

— Not even access control for cars (e.g. to decide access to parking spaces) needs to 
identify cars individually. The concepts of Partial Identities (ISO/IEC 24760-1, 
[15]) and Privacy-friendly Attribute Based Credentials [16] allow the limiting of 
information presented in such cases to what is really needed to gain access. For 
example, in Use Case 2 the certified information that a parking space was booked 
for the autonomous valet-parking of a vehicle does not need to identify the indi- 
vidual vehicle towards the access control system of the parking space. Transferring 
a presentation token that only identifies the vehicle if it is used twice (and is 
therefore misused) should suffice. 


3. Systematic deletion of PII: Data deletion is often neglected in concepts and life-cycle 
models for ICT systems. Especially in the case of PII, this can lead to dangerous 
misuse and consequential liabilities. Therefore, draft architectures in any of the cases 
should already be including concepts for systematic data deletion; this requires careful 
consideration as to how long which data need to be kept for which purpose. Within the 
German Standardization Organization DIN, and also at ISO/IEC, standardization ini- 
tiatives for data deletion have been started, see e.g. [17]. These initiatives build to a 
major degree on the data deletion concept of the German Toll Collect road pricing 
scheme for trucks. 
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24.6 Long-term Considerations 


It seems likely that any infrastructures for autonomous driving will be large, and therefore 
that any planning for their introduction, use, and maintenance needs to be long-term. 
A few remarks about long-term experiences should, then, be useful: 


1. Application creep: Once a technical infrastructure is established for some applications, 
new additional applications “piggy-backing” on the same technology and infrastruc- 
ture but with more privacy risks can be easy to implement. This has been experienced, 
for instance for the GSM mobile communication network, which has a lot of powerful 
functionality; or for localization, whose de-facto-introduction and exploitation in some 
countries has been a grey area. Related fears exist for road tolling systems and their 
surveillance infrastructures established for trucks or other commercial vehicles only. 
The extension to private cars may be easy. 

2. Creep from test systems to real systems: Experience in Internet software development 
shows that the step from a test system, or even an experimental prototype with reduced 
or no security or privacy protection, to a real production system may be as easy as 
changing the web link on a public portal to point to a new backend system. Such a 
change may lead to test systems being rushed into real production, while these systems 
may not be protected like real systems. Particularly projects that are short of resources 
and need quick success can be tempted by this strategy. 

3. Mandatory pseudo-unique identification: More and more computer devices store and 
issue identifiers that identify these devices more or less uniquely and reliably. One 
example is the GSM International Mobile Station Equipment Identity (IMEI). In 
theory, the IMEI is a unique identifier for every GSM mobile communication device; 
in practice, it can be manipulated. A similar situation exists for the Media Access 
Control address (MAC address) in Internet networks, which theoretically is a unique 
identifier assigned to network interfaces. Both identifiers also relate to cars equipped 
with the respective communication technology. While the security of these systems is 
low, they make (unofficial) data collections very easy and hence create major privacy 
problems. Moreover, they foster a recurring “appetite” in interested parties for more 
identification of users in communication networks or Internet services. This trend 
needs to be recognized, considered, and overcome [18]. 


24.7 Concluding Considerations 


One may think that a higher degree of autonomy in driving would lead to more data 
processing to enable the autonomous driving, and consequently to more surveillance. 
Actually, this is not necessarily the case. The two main factors leading to the collection 
and spreading of additional data through autonomous driving are: 
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1. The interaction between the vehicle and the driver(s), passenger(s) and possibly owner 
(s) becomes more intensive, which leads to the storage and processing of additional 
data. 

2. The interaction of the vehicle with other entities, especially with any kind of traffic 
control center becomes more intensive, which leads to additional transfer of potentially 
sensitive data out of the vehicle. 


An autonomously driving vehicle that drives sufficiently autonomously, that it does not 
need to interact with a driver, does not need to collect more data from a driver than any 
“conventional” car. Also, if the vehicle is able to autonomously navigate through traffic 
and reach its destination, it would not communicate more data than any other vehicle, and 
even less data, than a conventional car using a centralized navigation system and that is 
under surveillance, e.g. by a system that constantly collects the geo-coordinates of the car. 

Of course, some of the close-to reality intermediate scenarios, e.g. a vehicle handing 
over to a driver in critical situations (see e.g. Use Case 1) combined with a centralized 
surveillance in critical situation can lead to more surveillance and consequently more 
privacy problems. So while, in theory, vehicles driving more autonomously does not 
necessarily lead to more privacy problems, there is a realistic threat that in practice this 
will happen if the design and architecture do not carefully avoid privacy problems. 

Therefore, an approach of privacy-by-design for autonomous driving-scenarios is 
needed. At least for the following questions, one needs to perform a thorough check: 


— Is the collection, processing, or transmission of data really needed for a real 
improvement in the driving situation? 

— Is this advantage worth the additional privacy risks? 

— In potential dilemmas between more functionality and more safety on the one hand, 
and less privacy on the other, can the PII stakeholders (often drivers, passengers, 
owners) be enabled to decide for themselves and in an informed manner? 

— Do the data stay under the control of the PII stakeholders, or do they leave their 
domain of control? 


There is clearly a challenge to protect the freedom that has been associated with 
personal cars for a long time, and that is one of the reasons for their success. Perhaps a 
unique selling point for the established car industry, and especially premium manufac- 
turers and brands, is to not simply follow the easy trend of Internet businesses in letting 
information flow everywhere unless they get stopped by legislation or customer outrage, 
but rather to facilitate proper protection for their customers. The car industry has shown in 
other areas, for instance in the reduction of energy consumption, that one does not need to 
accept primitive solutions, but can overcome adverse effects and reduce resource usage by 
careful planning and engineering. The triggers for this approach will come anyway. 
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Part V 
Law and Liability 


Tom Michael Gasser 


The articles in the “Law and Liability” section examine, from a higher perspective, the 
respective significance of various legal systems for a social structure that allows for 
autonomous driving. The vantage point here is here primarily formed by, and partially 
limited to, the authors’ knowledge of the American and German systems of law, as well as 
auto industry practices. For the most part, however, the focus is on matters of overriding 
importance within the respective legal systems, the fundamental values of social order, 
and the probable long-term legal institutions and interests. This allows conclusions to be 
drawn on the forward-looking topic. Given this abstract approach, it should also be said 
for this section that all stated legal views on these matters of the future are those of the 
authors and are no substitute for legal advice in individual cases. 

To understand the challenges of the long-term objectives of autonomous driving, one 
must be aware that, so far, “autonomous machine activity” on public roads clearly accords 
with the day-to-day reality of very few legal systems. This also applies to individually 
proactive US states. Even if the trained eye of an expert is frequently required, today’s 
prototypical systems involving high degrees of automation mostly still assume a human 
driver’s presence as a supervisor for technical reasons. The greatest challenge from a legal 
standpoint lies in dispensing with this established and widely accepted driving activity of 
controlling the vehicle. The articles in this section lay out in detail the causes of the legal 
uncertainties brought about by this change. In part, it has been possible to identify 
questions for future research that may help to better understand any potential changes. But 
it has also been possible to derive strategies and recommendations that take these changes 
into account and may make adaptation easier. 

In his article Fundamental and Specific Legal Questions Concerning Autonomous 
Vehicles, Tom Gasser provides an in-depth examination of today’s road traffic and its 
dangers in light of the human right to life and physical integrity. Based on this, Gasser 
demonstrates that the basic change on the road to autonomous driving consists in tran- 
sitioning from driver-controlled vehicles to autonomous machine activity in public space 
without being able to wholly rule out dangers in this process. The author deems this 
change significant in respect of constitutional law. This examination of the legal impact of 
autonomous driving then goes on to look closer into the risks resulting from automation 
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and the hypothesis of the “dilemma situation.” Fundamental design requirements for 
autonomous control functions to protect pedestrians and cyclists result from this, as well 
as further research questions to determine the causes of traffic accidents in today’s road 
transport system. In the author’s view, a deep understanding of these causal processes 
could lead to further insights into the safe design of autonomous driving. Alongside some 
more specific issues, the article details the communication between road users. Here lies a 
need for fundamentally new concepts in the long-term objective of autonomous vehicle 
operation. 

Product liability in the United States is the focus of the article Product Liability Issues 
in the U.S. and Associated Risk Management by Stephen Wu. Risk management of 
product liability is a significant challenge that automobile industry and other firms in the 
sector have to face up to if their aim is to sell autonomous vehicles in the U.S. 
Autonomous-vehicle manufacturers may thereby be exposed to very considerable, pos- 
sibly even existential risks. The abstract-seeming risk and its triggering factors are 
illustrated with lively accounts of product liability cases in the automobile sector over 
recent decades. This overview makes the risks tangible and clear. Against this backdrop of 
experience, recommendations are given for product liability law risk management in the 
development and safety validation process. The manufacturer can minimize risks through 
careful preparation for potential product liability cases. 

Taking as its starting point an abstract analysis of the risks and uncertainties thrown up 
by both autonomous and today’s vehicles, Bryant Walker Smith outlines the considerable 
challenge that regulation represents in practice. In the conclusion of his article Regulation 
and the Risk of Inaction, he arrives at a total of eight recommendations for guiding 
strategy—mainly concerning public bodies, but also private stakeholders affected by 
autonomous driving. These strategies tackle either the risks themselves or the negative 
consequences and effects of autonomous driving. The argument of this innovative 
approach rests on the opportunities offered by vehicle automation. One of Walker Smith’s 
basic opening observations regarding regulation is on its necessity. If decisions in the 
areas that guide action are not taken by those responsible for an abstract decision, they will 
only be shifted to the next level in cases of materialized risk. This would lead, for 
example, to courts having to deal with the very same questions. 

Thomas Winkle’s article is on the Technical, Legal, and Economic Risks in the 
Development and Approval of Automated Vehicles. Based on many years’ expertise, he 
traces the technical improvements in vehicle safety over recent decades. Greater vehicle 
safety and reliability are faced with higher consumer expectations. Using Federal Court of 
Justice rulings on product liability, the author also depicts and gives substance to the 
expectations and requirements placed on automobile manufacturers. Particular attention, 
however, is given to the indirect economic effects of product crises on vehicle manu- 
facturers, of which customers’ loss of trust can be the severest consequence. The article 
shows real opportunities for manufacturers to impact vehicle safety in development and 
approval. These include not only the development of new approaches for new safety and 
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testing concepts, but also the recommendation of an internationally agreed Code of 
Practice based on the equivalent code for the safe design and evaluation of 
driver-assistance systems, which appears equally advisable for automated vehicles. With a 
historical glance back to the initial stages of the automobile, in the closing remarks it is 
argued how excessive perfectionism may hinder the introduction of an innovation. In 
conclusion, therefore, the conscientious and careful application of available expertise is 
proposed as an innovation-friendly approach to the development of automated vehicles. 


Fundamental and Special Legal Questions 2 5 
for Autonomous Vehicles 


Tom Michael Gasser 


25.1 Introduction 


The “Autonomous driving on the roads of the future: Villa Ladenburg Project” by the 
Daimler und Benz-Stiftung looks at degrees of automation that will only become tech- 
nically feasible in the distant future. The treatment of the legal questions in the present 
chapter therefore draws heavily on the description of the use cases (see Chap. 2), which 
begin to provide a concrete basis for evaluating individual issues. Uncertainties in pre- 
dicting future technical developments can be expected and will have a commensurate 
impact on the assumptions and conclusions of this chapter. The resulting uncertainty is 
nevertheless unavoidable if one wants to press ahead with important interrelated issues. 
This chapter is therefore intended as a contribution to the debate on societal aspects of 
automated driving from a legal perspective and not as a legalistic evaluation of the subject. 
The consideration will largely focus on the situation within the context of current German 
law. The legal views expressed are those of the author and are based on nine years of 
experience in the field of driver assistance system research. 

In terms of the underlying conception presented here, the societal dimension of 
autonomous vehicles addressed in the present project goes well beyond the adjustments to 
the legal framework currently being called for in Germany. The following will examine 
the question of “societal acceptance” in the context of the legal questions raised by 
autonomous vehicles. This line of investigation is not immediately obvious and covers 
only a segment of the more thoroughgoing focus of the project (see Chap. 29). 

Autonomous vehicles will presumably only attain widespread success when their 
overall societal benefits exceed the damage associated with them [1]. This early 
hypothesis, asserted in regard to driver assistance systems, must be regarded in relation to 
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the supremely important matter of traffic safety. The requirement would be fulfilled if 
overall traffic safety were improved through advancements in the vehicle technology 
(which, however, would not necessarily result in societal acceptance (see Chap. 29)). 
Even today it may be surmised that autonomous vehicles which are controlled on the basis 
of automated perception of the environment will not be capable of completely flawless 
operation. It may therefore be concluded that even with autonomous vehicles, there will 
continue to be individual severe damage incidents, which in extreme cases will include 
multiple human deaths. The societal acceptance of autonomous vehicles therefore nec- 
essarily depends upon societal acceptance of the consequences of these developments. 
From a legal perspective, the fundamental issue at hand is understanding and accepting the 
“effect of autonomous vehicles” in the public space as an independent “action” by 
machine. This situation in road traffic would indeed be totally new (other forms of 
transportation such as automated, driverless trains generally strictly implement the con- 
cept of separation between automated control and public space through physical barriers; 
there are, apparently, very few exceptions,’ which, however, seek to exclude any resulting 
dangers by means of exhaustive safety concepts nearly completely see [2]). 

The novelty of autonomous vehicles as effective actors in the public space of road traffic 
from a legal standpoint can be demonstrated—as will be attempted in the following—in 
order to highlight that societal acceptance of such a substantial change must indeed begin to 
take root (see Chap. 30) before it can begin to have an impact on the adjustment of relevant 
regulations. 


25.2 Previous Work and Preliminary Considerations 


To this author’s knowledge, the question of societal acceptance of driver assistance systems 
with machine perception was first raised by Homann [1] in the context of a working con- 
ference in October 2002. The contents of that paper can be applied to the present examination 
of autonomous vehicles. In this regard, it can only be concluded that the societal acceptance 
issue that was discussed at the time with regard to “new generation driver assistance systems” 
has yet to become anchored in the public consciousness as a “problem,” although the systems 
discussed back then have become available on the open market and sufficiently widespread 
to reveal the existence of any actual problems. This is presumably due to the fact that to date, 
spectacular negative effects resulting from such systems (as could be imagined in the case of 
emergency braking assistance, for example) have not been recorded. One reason for this 
could be that the systems do indeed function (almost) flawlessly. A more differentiated 
explanatory approach, however, is that any such interventions in the control of the vehicle 


"RUBIN project for the automation of the U2 and U3 subway lines in Nuremberg: Provisional 
mixed operation of automated and conventionally controlled trains was implemented on a route 
section between Rathenauplatz and Rothenburger Strasse. Moreover, the concept does not employ a 
physical barrier along the platforms, but rather a sensor-based platform safety system. 
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only occur extremely briefly in very accident-proximate situations. This suggests the use of a 
technical variant that only intervenes when the evaluation of the environment recognition 
system determines a very high probability that an intervention is indeed necessary, thus 
reducing negative effects to a minimum. It must also be taken into account that the driver still 
has the duty to perform all requisite control functions. Thus the driver potentially remains 
available as a comprehensive fallback level in all cases of non-activation. The result of these 
considerations is the relatively minor significance of such functions not only in terms of their 
share of active time in the overall control of the vehicle but also with regard to the reliability 
expected of them. Such functions can therefore only be used in a very limited capacity in 
conjunction with independent or autonomous vehicle control systems: The subordinate 
significance and a tightly circumscribed “field of action” of a function lead to a strengthening 
of the driver’s role. This is presumably an important reason why the discussion regarding 
societal acceptance has not taken place thus far. 

There is little reason to believe, however, that societal acceptance will play an equally 
minor role in the case of autonomous vehicles: If one takes the representative use cases 
used as the basis for the current project as a baseline (see Chap. 2), it becomes clear that 
they demonstrate a very high degree of automation. The “automated driving capability” of 
these use cases as a reference value is defined in greater detail in terms of “capabilities of 
perception, cognition, behavioral decisions and behavior execution” (see underlying 
definitions in Chap. 2). A machine-based “autonomy” of the vehicle emerges which 
makes it possible to speak of “driving robots” “as a subject ... analogous to the role of the 
driver in the vehicles of today” (see Chap. 2). At this point it becomes clear that we are 
speaking of a very fundamental shift that will be accompanied by the introduction of such 
automated decisions in the public space. 

Not much can be said about the question of societal acceptance of autonomous 
automated driving capabilities from a legal standpoint. However, what legal regulations 
will presumably reflect to a high degree is what can be regarded as amenable to consensus 
on the societal level—an assumption which can be regarded as justified, at the very least 
where individual regulations are not discussed and scrutinized by a wide swath of the 
public. Comparing autonomous vehicles with current law shows that the spirit of current 
regulations does indeed not cover independent “performance” by machines in the public 
space (understood as behavioral decisions and behavior execution as a new sense of 
automated action; see above). 

Laws should be abstractly/generally applicable to all life situations. This maxim also 
fundamentally applies to the stipulations of traffic law. But when changes to the realities 
of life emerge which cause previously fundamental presumptions to lose their validity, as 
would be the case in the eventuality of autonomous vehicles with decision-making 
capacities in the public space, this can only be represented through an application of the 
law. It is possible to precisely describe the emergent change and bring the overarching 
fundamental values of our society—such as basic rights—into the argument, which can 
provide a framework which will presumably outlive the changes and set the parameters for 
development. 
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25.3 The Current Traffic Situation as a Starting Point 


Fundamental state duties even with regard to road traffic accidents can be traced back to 
the constitution. In view of the hazards associated with road traffic, the basic rights 
relating to life and physical integrity [protected by article 2, paragraph 2, clause 1 of 
Germany’s Fundamental Law (GG)] are paramount. The scope of protection afforded by 
the basic right to life includes protection for all (universal fundamental right) not only 
against targeted homicide, but also against behaviors that may unintentionally (unintended 
interventions such as the effects of accidents) cause death. The state’s duty to provide 
protection is comprehensive and also affords protection against illicit interventions by 
third parties. This ultimately leads, where interventions cannot be justified, to a state duty 
to prohibit such interventions, for example by establishing rule of law [3]. 

Here a discrepancy between the realities of life in society and constitutionally grounded 
rights comes into focus. Notable in particular is the fact that “traffic safety [is barely 
discussed], although the still large number of traffic deaths and permanently severely 
injured accident victims provide ample reason to do just that” [3]. Indeed, in the media 
major traffic accidents are regularly treated as relatively insignificant matters of merely 
regional interest. The phenomenon that emerges from this view, namely that the dangers 
associated with the current traffic situation, excites so little interest and plays such a minor 
role in the socio-political discussion [4], which can at least be seen as an indicator of broad 
societal acceptance of this state of affairs. 

At the same time, the duty to protect vis-a-vis the “risks of technology” is critically 
important with regard to road traffic as well. Statistics are recorded on (severe) road traffic 
accidents (as per section 5, paragraph 3 of the Law on the Statistics of Road Traffic 
Accidents (StVUnfStatG), with research conducted by the Federal Highway Research 
Institute), which enables precise monitoring of traffic safety trends and accident causes 
(bearing in mind that the number of road traffic deaths has shown an overall decline for 
many years). Yet the significance of traffic safety extends far beyond this as a critical 
factor in traffic policy overall, including in (but not limited to) the establishment and 
adaptation of traffic-related (driver permission, vehicle technology, behavioral and many 
other) legal regulations, but also in the design of roadways, road maintenance, road 
equipment, and so on. In spite of these various efforts and ongoing improvements, the 
status quo of 3339 deaths and 374,142 injuries (in Germany in 2013) remains a reality 
with which no one can truly be satisfied. 

Finally, from a very fundamentally legal perspective, the question arises as to the 
constitutional rationale for these interventions in the fundamental rights to life and physical 
integrity. It can be argued on the basis of the mobility requirements of other fundamental 
rights-bearers associated with motor vehicle traffic and their willingness to subject them- 
selves to the concomitant hazards of such traffic on account of the benefits associated with 
it. But even that is not universally valid, in particular if one considers that the dangers that 
flow from motor vehicles, in view of the considerable operational hazards in comparison to 
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non-motorized traffic participants, does not allow for any utterly unambiguous argumen- 
tation: While with motorized traffic participants it can be argued that they are prepared to 
accept the increased danger associated with motor vehicles which they themselves create, 
this cannot be extended to pedestrians or bicyclists [3]. That said, pedestrians and bicy- 
clists, with 557 and 354 deaths, and 30,897 and 71,066 injuries, respectively (for 2013) [5], 
represent a significant share of all road traffic accidents in Germany. 

Nevertheless, it seems probable that across broad sections of the public, there will be a 
significant degree of consensus that the consequences of road traffic are acceptable in view 
of the mobility needs of society. If one were to venture the thought experiment of 
imagining significant limitations of motor vehicle traffic in the interest of improving traffic 
safety, this would at the same time mean failing to take account of some other important 
societal needs: Immediately effective (radical) changes would obviously be associated 
with substantial limitations on individual (motorized) mobility, as well as (and not only) 
the general freedom of action protected in the Basic Law under section 2, paragraph 1 
GG). Because such an approach would be extreme, its proportionality comes under 
scrutiny: Identifying any such measures which would be suitable to the task in view of 
roadway driving of a total of 724 billion kilometers (in 2013 in Germany) [5] and yet not 
result in severe consequences for the economic development of the country, the ability of 
people to carry out their jobs, the provision of public services and much more, is virtually 
inconceivable. Against this backdrop, the probability of a majority being in favor of 
restrictions with regard to motor vehicle traffic is low. The currently practiced approach of 
continuous improvement of traffic safety thus emerges—as the positive development 
heretofore attests—as successful, realistic and exemplary. The aforementioned appeal 
from a constitutional standpoint for a more vigorous debate on traffic safety does not in 
itself call into question the existing legal situation with respect to road traffic, but instead 
highlights, at this stage, the importance of traffic safety efforts in this context. 

But if one carries the pursuit of causes of the comparatively poor performance of road 
traffic compared to other forms of transportation, it is worthwhile to consider a funda- 
mentally unique factor with regard to road traffic. With the legal definition of roads as 
“public goods in public use ... [which] are made immediately available to the public for 
the established purpose without special permission”, including recognition of roads as a 
“multi-purpose institution” [6], attention is rightly drawn to a characteristic in which road 
traffic as we know it today—including the associated accidents—is rooted. As public 
goods in public use, roads exist not only for the purpose of changing locations (traffic in 
the narrower sense), but also serve to enable commercial and communicative traffic (traffic 
in a broader sense) [7]. Ultimately this definition of the purpose of “roads” gives rise to a 
multiplicity of traffic situations understood in terms of diversity of traffic participants, 
traffic scenarios, sudden, unexpected events and conditions and developments between 
traffic participants on roads. A comparable variety of possible interactions in which nearly 
the entire population is involved in some form or another and which would be associated 
with a comparable risk of injury is not to be found in any other area of life. Roads 
therefore have a multifarious function which typically is not the case for the space 
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occupied by other forms of transportation. This functional diversity has a significant 
impact with respect to the circumstances that must be considered in the context of vehicle 
control: The requirements for the safe conduct of the driving activity are complex and 
diverse in nature. The driver of a motor vehicle is called upon to perform comprehensive 
perception of the traffic situation, make decisions and execute appropriate actions on that 
basis, particularly with regard to hazard recognition. In terms of the legal framework, at 
present this task is primarily regulated through laws governing behavior and driving 
license requirements. Just what significance the diversity and complexity of the task when 
performed by an automated vehicle control apparatus will take on in terms of legal 
categories will be examined in the following sections. 


25.4 Assessing Autonomous Driving 


Against this backdrop, this project on “autonomous driving” raises the fundamental and 
far-reaching legal question as to how autonomous vehicles could be integrated into this 
agglomeration of factors in legal terms. A starting point for answering this question—as 
mentioned above—would be to re-examine and describe the characteristic of such vehi- 
cles as “driving robots” or “subject” analogous to the driver (see Chap. 2) and lay out the 
associated consequences of such an approach for real-life situations. 


25.4.1 Current State of Driver Assistance Systems Available 
on the Market 


To date, an action and decision quality exists only in the case of human action (which 
always exists at least in the sense of the driver’s own perception and decisions—or at least 
in the sense of a continuous duty in this respect). In fact this is the still current minimum 
requirement in terms of driver participation in controlling the vehicle: Current driver 
assistance systems in a broader sense can only aid the driver in controlling the vehicle, not 
act as a replacement. At the present moment (August 2014), a division of labor between 
the driver and the driver assistance system would be possible involving active control of 
the longitudinal and lateral steering of the vehicle (on the basis of independent, automated 
environment perception). But this control system currently possesses no independent 
decision quality: Rather, it is predicated at all times on the driver’s immediate intervention 
and resumption of control of the vehicle if required for whatever reason—for instance due 
to faulty perception of the environment by the system. Thus the driver maintains a 
superordinate role and responsibility, making the vehicle control by the system appear 
derivative and subordinate. From a technical view of this division of labor, this is cur- 
rently absolutely necessary, as the driver assistance systems currently available on the 
market are not capable of independently recognizing that all system limits have been 
reached. One characteristic warning (of several) in the instructions for the “DISTRONIC 
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PLUS” system (an adaptive cruise control and thus a longitudinal control system of 
Daimler Corp.) reads as follows (as of August 2014): 


WARNING 

DISTRONIC PLUS and the active blind-spot assistant are only aids designed to assist you 
while driving. 

They cannot act as a replacement for your attention. Responsibility for regulating the 
distance to other vehicles, for the driving speed and timely braking rests with you. Always 
pay attention to the traffic situation and your environment. Otherwise you might recognize 
hazards too late, cause an accident and injure yourself and others. [8] 


From this warning—which can be found in similar form with other currently available 
driver assistance systems—illustrates very clearly that the system can only assist the driver 
if the driver maintains uninterrupted attention to his/her own perception of the traffic 
situation. All of the control processes automated by the system must be checked by the 
driver and overridden as needed through appropriate control actions by the driver. 

Driver assistance systems are therefore described from a control engineering per- 
spective as a “redundant-parallel” form of the division of labor combined with the same 
tasks [9]. This description in terms of division of labor is indeed appropriate from a legal 
standpoint, but does not say anything about where decision-making authority lies in case 
of contradictory performance of the task. With current driver assistance systems, the 
authority to override the driver assistance system at any time always rests with the human 
driver. The proper use of the system that emerges from the operating instructions is always 
directed towards observing and assuring the proper performance of the system and making 
appropriate changes if the system is not acting as it should. 

If the longitudinal and lateral control of a vehicle—i.e. the two fundamental aspects of 
the driving function in terms of control—are both automated at the same time, this 
division of labor is described as partially automated [10]. This does not change the fact, 
however, that such systems are not capable of recognizing system limits on their own and 
are thus necessarily subjugated to the redundant-parallel perception, decision-making and 
action of a human driver (understood as performance of authority in the spirit of “override 
in the case of any recognizable need”). Thus with respect to automation which is subject 
to monitoring by the driver, the aspect of “authority” attains the legally decisive 
significance. 

The result, then, is that with regard to the driver assistance systems on the market to 
date, there is never an independent, but only a derivative action and decision quality 
residing in the vehicle control system, which only occurs under the complete authority of 
the driver, who continuously monitors it according to regulations. 


25.4.2 Autonomous Driving 


The matter is fundamentally different in the case of autonomous driving, which is 
examined here by means of four representative use cases (see Chap. 2). All four use cases 
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envision a driving robot that assumes the vehicle control function. Even the “Interstate 
Pilot Using Driver for Extended Availability” use case, which clearly recalls current driver 
assistance systems, does not indeed require that the “driver” actually perform any func- 
tions during automated driving that would correspond to our current definition of a 
“driver”. This emerges in the clear formulation that the driver “becomes a simple pas- 
senger during automated driving”. 

Thus autonomous driving essentially envisions a situation in which the 
redundant-parallel performance of tasks by the driver and the system gives way to— 
potentially temporally and spatially delimited—independent automated vehicle control by 
the system. The person now fittingly referred to merely as the “vehicle user” does still 
retain a “dominant” intervention capability in the aforementioned “Interstate Pilot” use 
case, which does not fundamentally differ from the “authority” in the case of driver 
assistance systems described in Sect. 25.4.1. However, the basis for performance is rather 
likely to be lacking: As soon as the role of the driver changes so dramatically that not only 
performance of the task but also observation of the traffic situation and the evaluation of 
the automated control decisions which are based on it are dropped, the significance of this 
“dominance” or “authority” is inevitably limited. Thus even where the vehicle user is 
paying attention to the situation, there is de facto no basis for performance of this 
“dominance” or “authority”. In the case of the two use cases distinguished by the spatial 
absence of the vehicle user (see the “Autonomous Valet Parking” and “Vehicle on 
Demand” representative use cases in Chap. 2), the lack of a basis for actually exerting 
“dominance” or “authority” is even more evident. 

The lack of a basis for immediate observation of the traffic situation as a starting point 
for vehicle control can only be interpreted as de facto independence or “autonomy” of the 
automated control system. The therefore decisive significance of the autonomy of the 
automated vehicle control system in the present context has naturally found its way into 
the name of the underlying project. 


25.5 Fundamental Legal Questions vis-a-vis Autonomous 
Driving 


Legal questions related to autonomous driving cannot, as touched on in Sect. 25.2, 
adequately, let alone exhaustively, be addressed in terms of the current legal framework. 
The reason for this is that in their creation and ongoing development, the legal bases of 
road traffic law could only take account of considerations that were in need of regulation 
at a given time. In the field of public road traffic, the question of autonomous vehicles has 
not arisen thus far—including in the context of driver assistance systems currently 
available on the market (see Sect. 25.4.1): Heretofore it could always be assumed that a 
driver would execute vehicle control at least in the sense of redundant-parallel task 
performance. If one looks at autonomous driving, by contrast, there is a shift of funda- 
mental significance towards independent automated vehicle control. 
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25.5.1 Risks of Automation 


For autonomous vehicles, it is assumed that “hardware failures and software failures ... 
[can] also occur with autonomously driving vehicles,” although such vehicles developed 
“with state-of-the-art technology” are classified as “at least as reliable and safe ... as 
current conventional vehicles are.” The following considerations also demonstrate, 
however, that there is a great deal of uncertainty in this regard since the “success rate” in 
terms of vehicle control is assumed to be “similar to the quality and success rate of human 
drivers”, but at present this represents only a conservative expert opinion which can only 
serve as a basis for discussion for the present project (see Chap. 2). Thus the performance 
of automated vehicle control systems cannot be definitively assessed; it may be assumed, 
however, that the risk of automation will remain, but at the same time will not be higher 
than the risk resulting from human vehicle control. 


25.5.1.1 The Automation Risks Against the Backdrop 
of Fundamental Rights 

If we now examine the aforementioned potential automation risk in light of the situation 
of today’s road traffic as it pertains to the fundamental rights to life and physical integrity 
(see Sect. 25.3), it becomes clear that the shift from human control to automated vehicle 
control would presumably be regarded as “critical to the exercise of fundamental rights” 
[11]. Due to the significant intervention that any such new automation risk would mean 
with respect to the fundamental rights to life and physical integrity, it must be regarded as 
probable that a decision regarding the allowance of automated vehicles and thus of an 
automation risk flowing from automated control systems in road traffic would fall under 
the purview of the legislative authority. The lawmaking body would bear the duty of 
making key decisions itself, flowing from the democratic principle and the rule of law. 
The critical provisions for the protection of fundamental rights should therefore not be left 
in field of action or decision-making authority of the executive [12]. This argumentation 
places the focus squarely on the novelty of such an automation risk because it would 
revolutionize vehicle control in general. At the same time, it must be acknowledged that 
the most realistic scenario for the introduction of automated vehicle control is gradual, 
step-by-step implementation by means of continual improvement of driver assistance 
systems available today (see Chap. 2). This raises the question of whether the transition to 
automated vehicle control will still be regarded as “critical” at the time when the decision 
is actually made. The Federal Constitutional Court has traditionally been rather restrained 
with respect to the parliamentary prerogative regarding the fundamental rights to life and 
physical integrity and has been satisfied to let questionable types of risks to life be covered 
by the legislative will expressed in the atomic energy act (Atomgesetz) [3, 13] (more 
specifically the “breeder technology” in that case). It is also not necessary to explicitly 
name the risks and consequences of road traffic that impact the fundamental rights to life 
and physical integrity (so there is no unconstitutionality of the road traffic act (StVG) 
flowing from this alone in current practice) [13]. Thus the question remains whether the 
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road traffic act in its present form can encompass the novel quality of automated control. 
At the time of this writing (August 2014), the novelty and independence of the automated 
decision quality raises considerable doubts. 

Should the underlying assumptions and relationships prove correct, the question of 
allowing for an automated control risk in public road traffic would have to be regulated by 
formal law (the so-called proviso of formal law). The legislator would be free to permit 
risks that remain “below the danger threshold” and which can therefore be justified, also in 
the light of freedom on the part of the person who causes the risk. However, the legislator 
is not restricted to this and can also become active below the danger threshold as a means 
of minimizing risk, insofar as this is still considered proportionate under constitutional law 
[3]. In terms of the magnitude of a potential automation risk, then, it seems—not least in 
view of the indicative effect of the situation in current road traffic—tealistic to presume a 
level of safety and thus also regulatory authority on the part of the legislator that remains 
within the scope of “at least as reliable and safe as current vehicles” (see Chap. 2). 


25.5.1.2 Liability of the Product Manufacturer for Autonomously 
Operating Vehicle Control? 
Product liability on the part of the manufacturer with fully-automated systems (see 
Chap. 2 for classification of the present use cases as “fully automated”) could be deter- 
mined in large part through the intended use of the product as defined by the manufac- 
turer. Insofar as system functions—as in the case of full automation—no longer envision a 
necessary role for the driver with regard to vehicle control, it could in turn be concluded 
that the acceptance of prima facie evidence in the event of accident damage is proper: If 
(accident) damage occurs in the course of automated driving, the question arises whether 
this can be attributed causally to an underlying product defect (insofar as the relevant 
cause is not due to an intervention by the driver in the form of an override action or 
exclusively the result of improper behavior on the part of another traffic participant—all 
within the context of the applicable burden of presentation/proof in civil suits) [10]. In the 
final result, the decisive question would be whether an incorrect automated control 
decision could ultimately be classified as a product defect and thus that in practically all 
cases of incorrect control, civil liability on the part of the manufacturer could be assumed. 
In that case, the manufacturer—in addition to the vehicle owner (see also [10])—would 
(almost) always bear the liability risk with respect to civil law for the automation risk 
associated with the automated action. In view of the expanded possibilities for inter- 
vention of automated vehicle control (see Sect. 25.5.2 for more on this), the scope of 
application for control-relevant errors would actually even expand vis-a-vis the driver. 
Whether this conclusion is appropriate, however, is another question: To a great extent, 
the argumentation follows the assumption that the cause of accidents today is regularly 
due to improper control decisions on the part of the driver. However, the (in future 
potentially automated) vehicle control may represent only one of multiple possible 
accident causes. 
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Current road traffic law still seems to be shaped by a different fundamental under- 
standing. This becomes clear for instance in the current edition of the road traffic act, which 
presumes the existence of “unavoidable events” (which in section 17, paragraph 3 of the 
road traffic act (StVG) still play a role in assigning the respective shares of responsibility 
for damage between motor vehicles). It must be emphasized, however, that of the cases 
currently encompassed by this, from a purely scientific standpoint and in consideration of 
the current state of technical capabilities it may be presumed that only some of these 
incidents will in future be considered “unavoidable”. Even so, to date the understanding of 
this legal term is only limited insofar as the “the greatest possible care” and the “behavior of 
an ‘ideal driver’” in terms of average performance expectations (as opposed to an imputed 
“super-driver”) are sufficient [14]. (There is evidently a different underlying idea here: the 
question as to responsibility for an accident, not scientific causality for its occurrence). 

Consistent application of the question of scientific causality could mean that only a 
subsection of damages occurring during automated vehicle control would in fact be 
traceable to a defective control system (or some other product defect). This would ulti- 
mately fundamentally call into question the aforementioned inference of damage due to 
the existence of a product defect during automated control. The open question in this 
context is therefore to what extent the current “road traffic system” represents an inde- 
pendently relevant cause for accident damage (vis-a-vis control decisions that might be 
automated). 


25.5.2 “Dilemma Situations” 


In the context of the legal discussion, the suggestive term “dilemma situation” encom- 
passes two interconnected aspects which can pointedly describe the characteristic prop- 
erties of automated action and illustrate the consequences of a worst-case scenario of such 
a transformation with exceptional clarity: first, the expansion of the scope of intervention 
in the control of the vehicle in time-critical situations and second, the question as to the 
implementation of an automated control decision within the scope of fundamental rights. 

To begin with, we must fundamentally question the existence of “dilemma situations” in 
road traffic. It is particularly unclear whether the underlying thought model of unavoid- 
ability is compelling. In road traffic, individual cases provide diverse, discreet and strongly 
situation-dependent opportunities to intervene in vehicle control. Preceding alternative 
control decisions in road traffic thus offer—potentially, this would have to be examined in 
greater detail—the possibility of taking action to prevent the occurrence of an unavoidable 
situation in which damage was inevitable. It would seem, then, that the possibility of 
preventing unavoidable situations through anticipatory vehicle control behavior cannot be 
excluded. On the other hand, it could turn out that certain hazards in road traffic arise from 
its very nature and are indeed not avoidable (for example due to the plenitude of possible 
interactions of differently protected traffic participants). In exceptional cases, the potential 
coincidence of two possible damages would then need to be assumed realistic, requiring a 
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consideration of “dilemma situations”. In legal categories, the question as to relevant 
accident causes is thus brought up which is subject to scientific determination both in terms 
of internal (vehicle control-dependent) and external (traffic system-dependent) factors. 

Irrespective of the result of this theoretical examination of vehicle control in road 
traffic, discussion-worthy aspects emerge from the consideration: Using “dilemma situa- 
tions” makes it possible to delineate a framework with respect to fundamental rights for 
automated control decisions. If one presumes the existence of “dilemma situations”, it also 
emerges that a limitation of the manufacturer’s responsibility could be called for in these 
cases because damages due to control actions would then be just as unavoidable as they 
would be in the case of the existence of independent risks flowing from the “road traffic 
system” per se (see Sect. 25.5.1). 

Finally, it should be noted that “dilemma situations” are also addressed in various 
forms in the discussion of ethical aspects, where they are likewise used as a means of 
illuminating and examining the overarching ethical considerations (see Chap. 4). 


25.5.2.1 Expansion of the Scope of Influence 

The conceptual model of “dilemma situations” for autonomous vehicles is based on the 
working hypothesis that certain acutely accident-proximate situations could still be 
affected by the use of automated vehicle control: In many cases it could therefore be 
possible to “save” materially endangered legal interests literally at the last second. With 
the current state of technology (and exclusively human vehicle control), these situations 
always require consideration of the driver’s reaction time [14]. The thus delayed control 
action can, depending on the case, influence the occurrence of an accident or its conse- 
quences. In fact this working hypothesis, taken in the context of a transition to automated 
control decisions, is by no means far-fetched. Further, it may also be assumed that another 
benefit could be achieved, namely that an automated control system could consider 
alternative control options, such as avoiding rather than braking for an acutely endangered 
pedestrian, which average drivers seldom succeed in doing [15]. One salient working 
hypothesis underlying the “dilemma situations” is therefore that automated vehicle control 
could lead to controlling traffic situations which were previously uncontrolled or only 
controlled after a delay. 


25.5.2.2 The Automated Control Decision 

A further assumption in the “dilemma situation” conceptual model which builds on the 
preceding takes account of the novel automated “decision quality” of an autonomous 
vehicle control system. This point of view is explicitly expressed in the designation of the 
“driving robot” as a “subject” which is revealed—with all due care in this regard—in the 
underlying definitions of the current project (see Chap. 2). In order to highlight this effect 
and argue the ethical dimension of automated control decision-making, a decision 
dilemma is brought in to accentuate the underlying quandary. This amplification is not to 
be regarded as a completely unrealistic scenario and worthy of discussion per se because it 
deals with the societal acceptance of a wide-ranging decision-making quality which is 
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hereby brought into focus. This automated decision-making quality can, in individual 
cases—as constructed in the “dilemma situations’—impact the right of the (acutely 
endangered) individual to life and physical integrity and is thus not fundamentally dif- 
ferent than in the case of the hazards affecting fundamental rights in road traffic as it exists 
today (see also Sect. 25.3). The major difference lies only in the underlying automated 
control. 


25.5.2.3 Critical Analysis of the “Dilemma Situation” 

In any theoretical analysis of the possible consequences of automated control decisions, it 
is only possible to do justice to the matter if it is made clear that the “dilemma situation” in 
the form of the “decision dilemma,” insofar as it exists at all, represents an absolutely 
exceptional case. In the interest of proper assessment, it must therefore be stated at the 
outset that this could only be an exceedingly rare exception. 

The assumption underlying the dilemma is that there is no alternative to damaging two 
essentially equivalent objects of legal protection in a concrete individual case although the 
automated vehicle control system has taken all alternative possible control decisions into 
account. But even if in the concrete situation—in consideration of the control behavior 
prior to the hazard becoming acute—there were no alternative to damage, relevant 
alternative causes to the control behavior in the antecedent causal chain could be con- 
sidered. It therefore seems plausible to assume that dangers may not reside exclusively in 
the vehicle control, but indeed inhere in the nature of road traffic in itself and thus flow 
from the complexity and variety of possible situations in the “road traffic system” as 
described in Sect. 25.3. This seems particularly probable where one considers the influ- 
ence of driving speed, for example, which in most cases presumably represents a nec- 
essary cause (in the scientific sense) in the occurrence of traffic accidents. But the 
“normal” driving speed is also simultaneously a component of the current understanding 
of the “road traffic system” and indeed largely defines it in some parts. The image of 
today’s road appears decidedly risky in individual cases: It is therefore appropriate to 
question whether in individual situations—for example when driving past a pedestrian—a 
risk exists [16] that could be adapted to address existing accident risks in road traffic. 


25.5.2.4 “Dilemma Situations” Against the Backdrop of Fundamental 
Rights 

The legal evaluation of “dilemma situations” should take its starting point in the over- 
arching legal framework, the fundamental rights. In the area of fundamental right to life 
and physical integrity nothing of fundamental significance changes due to the transition 
from human vehicle control to automated agency. In particular, it does not give rise to a 
“targeted” intervention in life or physical integrity, which in light of the importance of 
these objects of legal protection as the highest value and their fundamental significance 
would be impossible to justify for all practical purposes [3]. While every control decision 
is predetermined under particular external conditions by the programming of the 
respective system and thus is not random, as will need to be discussed in the context of 
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product liability as well, this does not in fact represent the specification of a particular 
course of action. Rather, the programming of an automated driving function (only) 
specifies which factors should be taken into account so that among multiple alternatives, 
the one which completely avoids damage, if possible, or causes the least damage, can be 
selected. It is particularly this situation-dependent consideration of alternative courses of 
action which represents the decisive added value of automated vehicle control, which was 
described as “Expansion of the scope of influence” through automated control in 
Sect. 25.5.2.1. Thus in the context of programming, no actual control decisions are made, 
but (only) abstract criteria for control decisions in individual cases specified. This illus- 
trates that ultimately it is still an abstract risk that is posed by automated control in road 
traffic. In terms of the fundamental rights, automated control would therefore not be 
handled differently than human vehicle control, which poses the risks presented in 
Sect. 25.3. Thus the associated unintentional damages to objects of protection (see [3]) 
which are equally caused by accidents under automated control in road traffic where an 
automation risk is assumed (see Sect. 25.5.1) should not be evaluated any differently than 
current risks in road traffic from the standpoint of the fundamental right to life and 
physical integrity. 

One aspect, however, should be given particular attention from a fundamental rights 
perspective: If it emerges that automated perception of the environment is sufficient to 
recognize non-motorized traffic participants (pedestrians and bicyclists) as such, their 
protection would have to be given particular weight in the action variants established to 
handle such situations (see the argumentation in Sect. 25.3). 

The decision dilemma described by the term “dilemma situation” between two 
equivalent objects of legal protection cannot be resolved, however, against the backdrop 
of the fundamental right to life and physical integrity: any trade-off between two equiv- 
alent values or, with regard to life, “absolute” fundamental right of other fundamental 
rights-bearers in terms of constitutional protection [3] is absolutely impermissible. From a 
legal standpoint, therefore—if one assumes the actual existence of such “dilemma situ- 
ations” in reality—there can be no contribution in the sense of a decision flowing from the 
current state of the fundamental rights dogma; rather, a novel question in need of an 
answer would be raised. It would therefore be of some importance to clarify the question 
of whether “dilemma situations” actually occur in this manner, and in particular whether 
the relevant cause of their occurrence can actually be traced back to the automated control 
decision and not to some inherent risk within the “road traffic system’—for example due 
to the driving speeds in certain situations (see also Sect. 25.5.2.3). If it emerged that 
“dilemma situations” exist and that their relevant cause resides in automated control, it 
would be essential to make this question transparent and—presuming societal acceptance 
of an automation risk—conduct a debate about it. It would presumably be necessary to 
create a catalog of recognized decision criteria for such situations. 

In all of this it would be essential to bear in mind that the question only arises in the 
first place through the expansion of the scope of intervention (see Sect. 25.5.2.1), which in 
most cases without a “dilemma” would lead to an improvement over the current situation. 
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The scientific comparison of the automated decision dilemma with the driver of today will 
in all likelihood demonstrate that in otherwise identical situations, the driver is not 
regarded as culpable, not least in consideration of the moment of shock accorded to the 
driver (see [14]). There is likewise no distinction between the scenarios with regard to 
“dilemma situations” in that damage occurs in either case. The reason for addressing the 
question would thus be due to the decidedly welcome development that technological 
advancements had made it possible to influence such situations and thus to save acutely 
endangered objects of legal protection. The weight of this argument will presumably carry 
the day in the end. 


25.5.3 Possibility of Override by Passengers 


The question of an override possibility of vehicles results from past discussions on driver 
assistance systems, which in large part draws on the concrete formulations of the Vienna 
Convention on Road Traffic of 1968 [17], which is still valid as of this writing (August 
2014). Although this was not specifically mentioned, the underlying thought is neverthe- 
less related to the question as to the duties of the driver in case of fully-automated vehicle 
control, which with respect to the applicable law in Germany has been described as 
contradictory [10]. The context can be described in terms of the concept of “dominance” or 
“authority”, which was taken as a basis in the “use cases” discussed in the present project 
(see Chap. 2). All four representative use cases envision a role for the driver or passenger in 
vehicle control, which diminishes as the scope of autonomy rises since other factors must 
be given precedence in the context of functional implementation. Even the representative 
use case examined here with the lowest degree of autonomy, the “Interstate Pilot Using 
Driver for Extended Availability” use case envisions that the driver “becomes a mere 
passenger during autonomous driving” such that he/she “[can] pursue another activity”. 
Thus even here there is a complete lack of a basis for an override capability at any time, 
which from the outset has always been regarded as factually (and not just technically) 
necessary. The factual override possibility by the driver was a reformulation of the initially 
uncontroversial “final decision authority of the driver” in driver assistance systems. This 
represented the subordinate role of driver assistance systems vis-a-vis the driver in vehicle 
control, where the system was regarded as having only a derivative authority to act and take 
decisions (see Sect. 25.4.1). Autonomous vehicles call this entire situation into question, 
such that it seems inadvisable to derive interpretations for future application from regu- 
lations that assume a human driver is taking part in vehicle control. This fundamental shift 
to independent automated action is already described in Sect. 25.4.2. 

With regard to fundamental rights, however, one aspect does bear a brief mention: The 
liberties of passengers of autonomous vehicles specified in art. 2 of the German Funda- 
mental Law provide an overall framework which—to the extent relevant in the present 
case—applies in particular to the right to personal mobility and personal freedom (see [3]). 
The limitations on these liberties resulting from autonomous vehicles do not seem as of 
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this writing to have been fundamentally called into question, as long as the passengers 
always have the possibility of causing the vehicle to stop at the nearest safe and appro- 
priate location. 


25.5.4 Error Compensation Capability in Autonomous Driving 


A “basic presumption” of the present project is that the use cases are deployed at the 
considered time in a mixed operation of transportation systems with different levels of 
automation ... ranging from “driver-only” to “assisted” to “fully automated” (see Chap. 2). 
This leads to the requirement that autonomous vehicles integrate in the existing traffic 
system. 

In the case of conventional vehicle control, as in the case of currently available driver 
assistance systems (in the broadest sense), which never enjoy actual autonomy (see 
Sect. 25.4.1), the German road traffic regulations (StVO) are applicable without exception. 
Drivers thus find themselves confronted with conflicting priorities of the “principle of trust” 
and “defensive driving”. The “Principle of Trust” means that properly behaving traffic 
participants under normal circumstances do not need to take all possible (rare) traffic vio- 
lations by others into account as a preventive measure. The “Principle of Trust” is necessary 
to maintain traffic flow. At the same time, the driver is called upon to “drive defensively” (to 
contribute to traffic safety) and thus apply more than the prescribed care (which in fact 
means partially hedging one’s trust in the proper traffic behavior of other drivers) without 
this “fundamentally” undermining the principle of legitimate expectation [14]. Just how 
these requirements are understood in individual cases, could be inferred from court rulings 
in Germany. However, the continental European norm of systematized statutory law can 
provide but a degree of orientation in this regard, but no precedence for individual cases, 
which ultimately means that the value of any such aggregation of rulings is limited. 

It must therefore ultimately be required of “mixed operation” vehicles that they meet 
(at least) the same standards required of drivers in order to ensure that they do not, at the 
minimum, cause any new hazards. In a precise description of the requirements on an error 
compensation capability, it must be noted that a significant degree of imprecision remains. 
If one translates the current legal requirements in road traffic into a definition of the 
capabilities required of an autonomous control function, it can only be asserted with 
sufficient certainty that autonomous vehicles must absolutely have error compensation 
capabilities. Autonomous vehicles would have to be able to take clearly identifiable 
inappropriate behavior by other traffic participants into account and adapt the automated 
control accordingly. According to current law, how this is achieved is left up to the 
judgment of the driver in individual cases. Just implementing this requirement alone from 
a technical standpoint would require an extremely sophisticated environment recognition 
capability and extremely complex decision-making processes; but these are—including in 
the case of the driver—not specifically defined, but rather taken as given in the context of 
the requisite suitability and permission to drive [18]. This lack of specificity concerning 
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the requirements could therefore prove too difficult for implementation in the form of an 
automated control system. 

In light of the uncertainty resulting from the antagonistic demand of “defensive driving”, 
the only remaining option at this point is the—potentially traffic-flow-compromising— 
overfulfillment of the error compensation capability to the extent of total risk exclusion. 
This leaves the question, however, of whether a significant restriction of the traffic flow 
would indeed be expected: due to the aforementioned expanded scope of intervention of 
automated control (see Sect. 25.5.2), automated vehicle control could actually prove much 
more capable than a human driver. This advantage, which is presently unmeasurable, could 
compensate for deficits in terms of traffic flow (although the resulting scope is equally 
unknown). 

In the question of the error compensation capabilities of autonomous automated control 
systems, it could prove beneficial to the cause of legal certainty to formulate uniform 
requirements targeted to specific objectives (comparable to brake effectiveness standards 
for vehicles, for example) that define and harmonize the state of the science and tech- 
nology. Such a catalog of requirements would presumably bear fruit in the legal definition 
of realistic capability requirements for autonomous control systems. 


25.5.5 Communication in Road Traffic 


As concerns communication, for road traffic the currently existing options can be assumed. 
The use of some vehicle-based light and audible signals—such as headlight flashers, turn 
signals and hazard warning lights—if present, is explicitly prescribed by the German Road 
Traffic regulations. For example, warning signals (use of the hazard warning light) are 
prescribed in the case of hazards with school buses, when passengers get in or out, or as a 
warning when approaching the end of a traffic jam, with stalled cars and cars being towed 
[see also sections 15, 15a, 16 of the road traffic regulations (StVO)]. Section 5 paragraphs 
4a and 5 of the road traffic regulations (StVO) prescribe and allow the use of turn signals 
and headlight flashers, respectively, in the context of overtaking maneuvers. The use of 
turn signals is prescribed, if available on the vehicle, when turning [section 9 paragraph 1 
of the road traffic regulations (StVO)] or starting up [section 10 of the road traffic regu- 
lations (StVO)]. Through this standardized, formalized communication, the road traffic 
regulations achieve simplified expectations among other traffic participants [19]. 

Alongside this, an informal (or not legally secured) use of (light) signals has established 
itself which, however, is not envisioned by the road traffic regulations (flashing the high 
beams, for instance, can also represent ceding the right of way to another driver in Germany). 
It should be noted, however, that such a use of the signals is no longer subject to the principle 
of legitimate expectation in road traffic because it cannot be regarded as “traffic-appropriate” 
behavior (and, incidentally, also represents a major risk for misinterpretation). 

Immediate verbal communication from within closed vehicles in road traffic is rendered 
more difficult or even impossible due to the physical separation of the driver from the 
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immediate environment and the noise level of the surroundings. Even informal commu- 
nication through simple gestures is considerably compromised due to the reflective effects 
of today’s typically tinted and angled vehicle windows. Nevertheless, even the road traffic 
regulations offer up an application in the case of “special traffic situations,’ which 
envisions unspecified informal communication [as a special legal variant of the duty of 
care and consideration in section | paragraph | of the road traffic regulations (StVO)]. For 
instance, if it is necessary to cede the right of way, this requires communication with the 
driver yielding the right of way as per section 11 paragraph 3 of the road traffic regulations 
(StVO), providing that this communication is conducted in an unambiguous manner—in 
exceptional circumstances, even flashing the high beams can thereby be used to further 
clarify intent [14]. 

In view of existing communication challenges (see also Chap. 7), beforehand action, in 
particular when expressed in the form of motion, can also represent an indication of the 
intended target actions [19], such that the road traffic behavior which can be perceived 
from the outside such as stopping, braking and starting up also attain major significance in 
the context of informal communication. Such conduct is also explicitly envisioned by 
section 8, paragraph 2 of the road traffic regulations (StVO), which specifies that in 
right-of-way situations, the party required to wait shall “indicate through driving behavior 
that he/she will wait.” 

Aside from the nonverbal nature and anonymity, the complexity of the situation is also 
singled out as a characteristic marginal condition for communication in road traffic. This 
complexity is particularly determined by the speed and fleeting nature of the communi- 
cation in road traffic [20]. 

This enables us to identify some initial important conclusions for autonomous driving: 
While standardized, formal communication may represent merely a challenge for machine 
perception and interpretation and may indeed be possible to program automatically in the 
other direction, the question arises at this point already as to the degree to which other 
drivers can only recognize automated control or how this could be implemented. Con- 
sequently, in the “mixed” communication relationship with machines, the question further 
arises whether other drivers would trust the contents of formal communication. This 
would at least predicate knowledge of the respective capabilities of autonomous vehicles 
in order to allow communicative interaction to function. The case could even arise that 
other traffic participants feel a need to reproduce the content of automated communication 
(for example after an accident) in order to develop a willingness to trust in 
machine-generated communication content. 

While the resulting challenges in the case of formal communication appear amenable to 
resolution, informal communication in mixed operation is characterized by much greater 
challenges [mixed operation is the basis of the present examination (see Chap. 2)]. In this 
area there is a need to find approaches which would establish a bridge between 
machine-controlled vehicles and other traffic participants. Ultimately this conflict flows 
from the cause already described in Sect. 25.5, namely that detailed situation-specific 
regulation of communication between human drivers in road traffic is not strictly 
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necessary and that implementation can be left to the traffic participants according to 
situation. This informal communication between traffic participants may be subject to 
conflicts and in need of improvement [20], yet it can still be presumed that drivers are 
generally able to resolve this challenge in all situations—not least as this is necessary to 
guarantee the situation-specific adjustment that is required for road traffic in the first place. 
With the introduction of automated vehicle control, the machines would lack this 
human-specific capability of achieving understanding though such unspecified means; 
indeed, the machine may lack even the capability of recognizing that such communication 
is called for. The prerequisite for human communication is establishing a reflexive 
attentiveness to the communication partner and mutual perception [19]. This illustrates 
clearly that “mixed” communication still requires fundamental approaches for bridging 
this communication gap with machines. This would have to be a fundamental prerequisite 
in order for a mixed road traffic scenario including human drivers and machine-controlled 
vehicles to function. 

At the same time, the importance of communication for the implementation of auton- 
omous driving can be rated according to how important informal communication proves in 
a given situation—an apparently very challenging task from a technical standpoint. The 
abovementioned speed and fleeting character of communication in road traffic would 
presumably differ significantly based on the environmental conditions and driving speeds. 
Simply structured, extremely fleeting environmental conditions such as on a highway, 
where the driving speeds generally require formal communication, could substantially 
simplify the implementation of autonomous driving in that context and minimize the 
apparent necessity of adapting autonomous vehicles to the requirements of informal 
communication (in comparison to communication needed for an urban traffic 
environment). 

It may also be assumed that the challenge posed by communication will only occur in 
mixed traffic because, particularly between autonomous machines, the problem seems 
eminently manageable from a technical standpoint (via cooperative systems). Moreover, 
for mixed traffic the significance of beforehand action expressed in motion, and how it can 
be used for future communication in road traffic, must also be examined. Of particular 
interest is the question which situations can be unambiguously resolved by it. At the same 
time, there is the risk that an automated driving system—with a set-up designed to take 
full account of the error compensation capabilities of other traffic participants (see 
Sect. 25.5.4)—could indirectly compromise traffic flow if its configuration were taken 
advantage of by other traffic participants. 

Finally, it may be concluded with regard to communication in road traffic that here, too, 
a catalog of technically implementable communication strategies for autonomous vehicles 
in the form of a catalog of requirements would be advisable as soon as technical feasibility 
is foreseeable. This summarization of the technical features required of autonomous 
vehicles with regard to communication will be necessary over the long term, particularly 
in mixed traffic, and could substantially advance the discussion on possible communi- 
cation concepts. 
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25.5.6 Violations 


Through section 24 of the Road Traffic Act as a blanket provision in conjunction with the 
regulatory offenses specified by the road traffic regulations (StVO, section 49), the vehicle 
registration regulations (FZV, section 48), the road traffic licensing regulations (StVZO, 
section 69a) and driver licensing regulations (FeV, section 75), violations of prohibitions, 
duties and orders are generally prosecuted against traffic participants and vehicle owners 
[14]. Punishable offenses also include road traffic-related violations from the 28th section 
of the criminal code (StGB) on offenses dangerous to public safety (noteworthy in the 
present context are external interventions in road traffic as per section 315b StGB and 
hazards in road traffic as per section 315c StGB). It is evident that the machine-controlled 
conduct of autonomous vehicles would obviate the application of these provisions: 
Regulatory offenses and criminal provisions are always linked to a human action, which is 
lacking in the autonomous scenario. 

The existing regulations, which carry penalties under criminal law or as regulatory 
offenses, also have an indicative effect concerning what behavior in road traffic not only 
impacts public order, but may, in line with our focus here, especially compromise public 
safety. The traffic regulations are “to be handled and interpreted in an elastic 
(traffic-appropriate) manner and without pettiness;” this applies equally, in the case of 
special regulations, to those which may impede or endanger [14]. Moreover, section 16 of 
the law on regulatory offenses provides a standard for legitimate emergency, which 
permits actions contrary to the law, including traffic regulations, in cases of acute danger 
to life, limb, property or other objects under legal protection in order to prevent imminent 
harm. The dangers must be grave, however, and the defensive actions commensurate to 
the dangers. Although the respective cases must be handled in a restrictive manner, not 
least to prevent specious assertions, this is ultimately a normative instrument to enable an 
appropriate consideration of the interests of different objects of legal protection in indi- 
vidual cases in a consistent and thus constitutional manner. The violation itself is subject 
to the same standard, such that its most extreme limit for road traffic is ultimately defined 
by the “danger threshold” for other traffic participants (see [21] on the question of the 
consideration of traffic safety in the context of the defense of necessity as a justification as 
per section 16 of the law on regulatory offenses). 

If the introduction of autonomous driving is taken into account against this backdrop, it 
may be assumed that the interests would remain unchanged—at least for the mixed traffic 
scenario of autonomous and driver-controlled vehicles on which this study is based (see 
Chap. 2). A change could occur if—due to a very high degree of automated-system 
mastery of the automated control risk associated with a violation—the described con- 
sideration finds that the violation does not result in an increased risk. This would, of 
course, call into question the very rationale for the rule itself: “Violation” of the rule 
would then not actually produce any disadvantage in the context of mixed traffic. 

It is also conceivable, however, that autonomous driving will lead to a need for 
considerably more detailed traffic rules which are significantly less flexible (which would 
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in turn raise the question of societal acceptance again). Such a restriction of the existing 
situation would in turn require a more detailed catalog of requirements in terms of the 
technical control capability of autonomous vehicles as soon as they become foreseeable 
from a technical standpoint. This would make it possible to identify consequences, 
including in the case of violations, in much greater detail than is currently possible. 


25.6 Special Legal Questions Related to Autonomous Driving 


As regards the evaluation of fully-automated, driverless driving in terms of legal regu- 
lations and product as well as road traffic liability, the introductory passages on these 
issues can be referred to (see Sect. 25.4.2 as well as the introduction to Sect. 25.5). In 
summary, the principal conclusion we may draw in this regard is that the legal regulations 
and traffic law provisions [in particular the road traffic act (StVG), road traffic regulations 
(StVO), road traffic licensing regulations (FeV) and the regulations authorizing the use of 
vehicles for road traffic (StVZO)] at the time of their establishment could only consider as 
objects of regulation what was known in terms of the state of technology in road traffic. In 
all aspects of public road traffic, there is an underlying presumption that a driver will 
personally perform vehicle control. It is accordingly true of all available systems that they 
do not possess an independent decision-making quality (see Sect. 25.4.1), but indeed 
require that the driver be at least “an active monitor’ at all times. 


25.6.1 Legal Assessment of Driverless Vehicles 


If the legal assessment of fully-automated driving [10] is therefore further extended to 
completely unmanned vehicles and passengers who are not able to control the vehicles 
themselves, clearly there would initially be no change in the present incompatibility with 
current regulatory law, which does not take account of this technological development. 
At the same time, it must be noted that driverless and completely autonomous vehicles 
(see the representative use cases “Autonomous Valet Parking” and “Vehicle on Demand” 
in Chap. 2) differ significantly in the requirements for the legal framework from those 
which call for an “available driver”. With the continued option of vehicle control by the 
driver for certain sections of a trip or due to a desire on the driver’s part to take control, the 
same fundamental requirements (suitability and competence to drive; see also [18]) must 
be fulfilled that are currently required of drivers—in the case of “Full Automation Using 
Driver for Extended Availability,” at least when the driver intends to make use of the 
possibility of controlling the vehicle (i.e. perform an independent act of driving). As such, 
there is no need for a fundamentally different legal framework, but simply one augmented 
by necessary regulations governing autonomous vehicles and thus an independent, 
machine-based decision-making quality. With regard to this independent, machine-based 
decision-making quality, then, one arrives at the same result from a legal perspective for 
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all of the use cases. The transformation resides primarily in enabling independent, auto- 
mated agency and how that is shaped. The framework for automated vehicle control from 
a legal standpoint is currently unregulated, although regulation seems called for (at least in 
the spirit of road traffic regulations as technically effective regulation). 

Insofar as a need for regulation of autonomous vehicles does not emerge naturally from 
the novel machine-based automation risk (see Sect. 25.5.1), it would seem that at least in 
terms of the use of suitable functions in mixed traffic relating to error compensation (see 
Sect. 25.5.4) and communication capabilities (see Sect. 25.5.5) of autonomous vehicles, a 
need for legal regulation seems evident. In the legal regulation of such interactive 
behavior, it must be examined precisely how far the role of the driver even extends in 
individual cases. If one considers the technical capabilities resulting from solely 
machine-based mobility in a given case (as described in the “Full Automation Using 
Driver for Extended Availability” and “Vehicle On Demand” use cases), the heretofore 
fundamental requirements of a driver’s driving suitability and driving competence already 
appear superfluous. The manifold possibilities could therefore give rise to an unprece- 
dented variety of regulatory duties for participation in road traffic with (autonomous) 
vehicles, which could be distinguished primarily by the reach of the automated control 
quality and to what extent it is intended to be used. 


25.6.2 Evaluation of Autonomous Driving According to Liability 
Law in Road Traffic 


As concerns the shift towards automated agency which is associated with autonomous 
driving, it is likewise the case with road traffic liability law that the existing regulations do 
not take account of this change. 


25.6.2.1 Keeper Liability 

Nevertheless there is in this area a fundamental German liability regulation for motor 
vehicles [section 7 of the road traffic act (StVG)] according to which the keeper of the 
vehicle, regardless of fault in the operation of the vehicle, is liable for compensation of all 
causally related damages which are not asset damages [where the only remaining reason for 
exclusion of liability is force majeure, section 7 paragraph 2 of the road traffic act (StVG)]. 
Thus even today, this restriction to operation of the vehicle as a liability-triggering legal 
definition does not make a distinction based on whether damage was caused by the driver’s 
conduct or due to technical failure. Since automated control decisions which cause damage 
can without contradiction be classified as technical failures, there is no fundamental 
inconsistency in this regard. 

The vehicle keeper is the person who uses the vehicle for his or her own account, in 
particular who draws the benefits and pays its expenses and thus also has the authority to 
decide regarding its use as a potential source of hazard [14]. If one assumes that driverless 
vehicles, too, can be assigned to a keeper, which would be possible without inconsistency 
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according to current law, no incompatibility with current law would arise in this case. 
Autonomous driving would nevertheless change the matter of keeper responsibility— 
however, the keeper responsibility for autonomous driving is already covered by the 
wording of the applicable regulation today: The vehicle control previously conducted by 
the driver is replaced by an automated vehicle control system (as far as the scope of 
application of the respective autonomous control reaches). Concerning the keeper 
responsibility, therefore, there would be no new duties, but rather a completely different 
control quality which triggers civil liability. 


25.6.2.2 Driver Liability and Accident Data Recording 

Other regulations of the road traffic act which are relevant for civil liability do, however, 
clearly assume control by a driver, for example section 18 paragraph 1 of the road traffic 
act (StVG), according to which in cases of keeper liability a liability on the part of the 
driver is likewise presumed (see clause 2). Thus we see that section 18 of the German road 
traffic act (StVG) also merely assumes the heretofore always correct presumption that a 
driver is always responsible for the control behavior of the vehicle. Ultimately the 
assessment of driverless vehicles from a liability law perspective does not differ sub- 
stantially from fully-automated [10] vehicles. The situation is similar with the heretofore 
applicable provisions of the German Civil Code (BGB) covering unlawful behavior by 
drivers (e.g. section 823 paragraph | BGB or section 823 paragraph 2 BGB in conjunction 
with violations of the road traffic regulations): These provisions can no longer cover the 
case of automated agency because they are linked to human action which is not applicable 
to autonomous vehicles. 

In the autonomous vehicles which are the subject of this study, which in some cases do 
not even require the presence or occasional assumption of control by a driver, the question 
must be addressed to what extent it may be assumed in a typical case that vehicle pas- 
sengers will be capable of describing the course of an accident. This illustrates that with 
respect to the question of compensation of accident damages occurring between two or 
more autonomous vehicles, the apportionment of damages according to applicable law and 
thus section 17 of the road traffic act (StVG) is confronted with the problem that the 
principally applied “degree of causation” [14] no longer—as is commonly the case today— 
can at least be supported through hearing of the drivers (generally also parties to a civil case 
—as the case may be also witnesses). This is due primarily to the role change in which the 
driver becomes a “mere passenger” (see Chap. 2) and is therefore able to make statements 
regarding the course of an accident only in exceptional cases and only on the basis of 
chance observations. Thus a change is introduced which even with respect to liability law 
in road traffic would seem to require technical measures (such as crash data recording 
during automated vehicle control) as a basis for the corresponding damage apportionment, 
insofar as the desire exists to maintain this distribution principle according to shares of 
causation for autonomous driving as well (which does indeed seem possible). 
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25.6.3 Evaluation with Respect to Product Liability Law 


The field of product liability for automated control of autonomous vehicles was already 
discussed in Sect. 25.5.1. The salient question here is determination of the relevant cause 
of accident damage in individual cases in the sense of scientific causality. 


25.6.3.1 Significance of Accident Data Recordings in Autonomous 
Driving in Terms of Product Liability Law 

Going further, for the cases of autonomous driving which require a “driver for extended 
availability” (see the use cases “Interstate Pilot Using Driver for Extended Availability” 
and “Full Automation Using Driver for Extended Availability” Chap. 2) there is another 
aspect which in turn stands in relation to the question of crash data recorders. Both in 
terms of product liability law (as well as with regard to violations of regulatory law subject 
to fines) it seems reasonable to assume that an active available driver could argue the 
exculpatory defense that he/she was not controlling the vehicle him/herself, but with the 
aid of the autonomous control system. If one wishes to preclude such assertions, it will be 
difficult to avoid considering the recording of vehicle control data—at least during 
autonomous control—in order both to protect the interests of the manufacturers in terms of 
product liability law and to secure evidence with respect to regulatory violations. This 
option does not seem excluded a priori from a data protection standpoint provided that the 
data remains in the vehicle, the transparency requirement is granted and data processing is 
conducted only to the extent necessary, or that data is, for example, only permanently 
stored in the event of accident damage. Moreover, a restriction of data recording to the 
period in which the vehicle was under automated control would have to be considered 
which would meet the principle of data minimization [section 3 of the German Data 
Protection Act (BDSG)], which incidentally would equally arise from the principle of 
proportionality with regard to data processing. This would also largely avoid the recording 
of behavior related data on the driver’s control of the vehicle. Particular attention would 
also have to be given to the transitions between the respective periods in which the driver 
and the automated control system are driving. Data recording could be of particular 
importance in this transition period, although it would simultaneously deal with data 
clearly related to the driver. As such, it would be necessary to clarify in an initial step the 
extent of recording required for a driver-controlled drive to protect against subsequent 
exculpatory defenses. 


25.6.3.2 The State of Science and Technology in Autonomous Driving 

From a product liability law perspective, the significant aspect for the layman would 
appear to be the question of exclusion of liability for errors in the context of automated 
vehicle control which the latest science and technology cannot identify at the time of 
introduction (development risk). In this context of product liability law, we must return to 
the question raised in Sect. 25.5.1 in which it appears possible in the context of road traffic 
that risks which manifest themselves in accidents could also be traced back to the current 
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traffic system as a relevant cause (and not in all cases to the control behavior, whether by 
drivers or automated control systems). This question is fundamental and needs to be 
answered as a matter of priority in order to avoid erroneously inferring that (alleged) 
product defects are the relevant cause. 

But as soon as the grounds for exemption from liability are affected in view of the state 
of science and technology, it must be taken into account that this exemption in practice is 
of decidedly minor significance. Whether a hazard was indeed recognizable according to 
the state of science and technology is to be tested in two steps: First, it must be established 
whether the error was recognizable for any scientist or engineer in the world. If that was 
the case, claiming the exemption is still not yet ruled out, because the decisive factor 
would be the objective accessibility of that knowledge for the manufacturer. It would also 
be necessary to take into consideration deviating opinions by individual scientists, pro- 
vided that those opinions satisfy the minimum requirements for scientific work [22]. 

As such, it is equally critical to determine for autonomous vehicles whether the rec- 
ognizability of an error could indeed be ruled out at the time of introduction (which indeed 
would also have to be provable in retrospect in the event of an accident according to the 
applicable standards of presentation and proof in civil suits). Only in this rare case would 
the manufacturer gain legal certainty through the use of these grounds for exemption of 
the development risk [and if not at fault, also according to section 823 paragraph 1 of the 
German Civil Code (BGB)]. In practice, this case will be of nearly no importance. 

Cognizance of the fact that product defects cannot be entirely ruled out even according 
to the latest science and technology and the observance of all due care, i.e. that a “residual 
fault tolerance”—as the ISO 26262 standard words it—exists, must be regarded as a 
technical description of the development process which has no correlation in product 
liability law. 


25.6.4 Possible Differences of Legal Evaluation 
in the International Context 


First, it must be noted that the present chapter from the outset only considers the situation 
from the perspective of German law and makes assertions on the basis of German law 
currently in force. Applicability to other countries must be considered limited. Transfer- 
ability of the conclusions here will, aside from coincidental reasons, be most likely in the 
event of harmonization of laws due to international agreements (in the context of inter- 
national law) or through regulations and directives issued in the context of EU law. 

It is therefore salient to add that, as concerns the fundamental rights situation depicted 
here, there is a largely concordant standard of fundamental rights—for our present pur- 
poses in the context of the German fundamental rights to life and physical integrity— 
recognized for example through the European Union’s Charter of Fundamental Rights. It 
bears references to the European Convention on Human Rights and, with the exception of 
the United Kingdom and Poland, the EU fundamental rights charter was declared binding 
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for the countries of the European Union through a provision in the Treaty of Lisbon. The 
rights to life and physical integrity are explicitly recognized therein—in particular through 
article 2 paragraph 1 and article 3 paragraph 1 of the Charter of Fundamental Rights of the 
European Union (see also [23]). This interpretation could be extended almost at will to the 
constitutions of other states; the chief conclusion, however, is that the fundamental rights 
framework can differ significantly in many individual areas. Such an examination is 
therefore the realm of specialists in the respective legal contexts. 

This applies equally to the regulatory law of road traffic as well as to the liability law 
being applied which is relevant for autonomous driving. But as we have seen in 
Sects. 25.6.1 and 25.6.2, the legal situation according to German law is to a great extent 
only transferable to autonomous driving to a very limited degree. It seems quite possible 
that a comparable situation would subsist in other legal systems as well. This assumption 
is also supported by the fact that international road traffic accords such as the Vienna 
Convention on Road Traffic of 1968 and the Geneva Convention on Road Traffic of 1949 
are based on a definition of the driver and continuous vehicle control which is highly 
comparable to that of the German road traffic regulations. 

In the interest of greater comparability, the product liability law which was harmonized 
within the European Union through council directive 85/374/EEC of 25 July 1985 rates a 
mention. Here again, in addition to restrictions in terms of legal doctrine, uncertainties 
arise due to the fact that the directive’s implementation is binding only with regard to the 
objective (a principle that existed even prior to the current situation and which finds 
expression today in article 288 paragraph of the Treaty on the Functioning of the Euro- 
pean Union). Yet there is a comparable legal foundation for intra-state application which 
is not linked to culpability (so-called strict liability). 

In sum, it can be concluded that in these areas, there are still significant differences 
which could impact the development of autonomous driving. Due to the national variations 
within the field of law, however, the impact cannot be predicted in detail and remains—as 
far as can be ascertained today—in need of further examination. 


25.6.5 Special Question: Supervisory Duty with Regard 
to the Passengers of Autonomous Vehicles 


One of the benefits of autonomous driving is that the attention resources of the human 
occupant are no longer required for the task of driving. This could potentially call into 
question the necessity of the presence of the “driver,” or indeed the person with a supervisory 
duty at all. Thus a significant benefit of autonomous driving could be that the mobility desires 
of children—without requiring a driver—could be fulfilled. It is therefore by no means 
impossible that dangers could arise from this if—as presumably would often be the case— 
the driver is the person with a supervisory duty who is no longer present in the vehicle. 
However, of the representative use cases examined here, only the “vehicle on demand” 
case would appear suitable for performing such a transport activity without the 
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accompaniment of a person with a supervisory duty. Even the representative use case 
“Full Automation Using Driver for Extended Availability” calls for the presence of a 
driver to drive in zones or sections of roads not approved for autonomous driving (see 
Chap. 2). Since the “Vehicle on Demand” representative use case does not even have a 
driver’s seat (but only a completely freely-usable interior space), dangers and effects 
flowing from use by persons requiring supervision would seem to be limited to the interior 
of the vehicle and not relevant for road traffic. Thus the question of the absence of the 
person with the supervisory duty would not be relevant for road traffic. It is, however, 
every bit as plausible that such autonomous vehicles would indeed have driving controls. 
In that case there would be the possibility of a significant negative influence over vehicle 
control by means of overriding the autonomous driving functions through the control 
elements. 

It is clear, however, that the legal question of a duty to supervise does not depend on 
the introduction of autonomous driving. Indeed, even today independent compensation 
obligations can be triggered by violations of the duty to supervise [see section 832 of the 
German Civil Code (BGB)]. The law stipulates a parental duty to supervise children in the 
exercise of parental care, sections 1626 and following BGB. Thus it would be necessary to 
determine the intensity of supervision required in view of the predictability of damaging 
conduct in an individual case based on the age, maturity, character, knowledge and 
abilities of a child [24]. If the resulting duty is violated and damage occurs on account of 
it, an independent claim for damages (aside from any claims lodged against the child) 
could be leveled against the parents of the child as well. Thus the possibilities arising from 
the advent of autonomous vehicles could result in the correct fulfillment of supervisory 
duties in this context receiving a novel, heretofore completely unknown meaning. A need 
to alter the legal basis is not foreseeable, however. 


25.7 Conclusion 


The examination of autonomous driving from a legal perspective undertaken in the pre- 
sent chapter reveals—in addition to the questions raised in the respective subsections—in 
particular a fundamental aspect which may take on greater prominence in the context of 
the transition from human to automated vehicle control than was previously the case. Even 
if we were to assume today that every accident involving motor vehicles were due to faults 
in the control of the vehicle, it must be examined scientifically to what extent the current 
traffic system, in view of the conditions under which it operates, does not itself represent a 
relevant cause for some portion of the accidents which take place today. The answer to the 
question is not to be regarded as an end in itself, but as a means of understanding whether, 
and if so, which changes in the vehicle control scenario are suitable under certain con- 
ditions to prevent accidents. This question is also decisive for the design of a safe product 
from the manufacturer’s point of view in terms of developing appropriate autonomous 
machine-based control functions. 
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It would also appear that the description of an automated control quality in the sense of 
a definition of requirements will be an important milestone in the ongoing advancement of 
autonomous driving in terms of legal certainty both for the operator of the vehicles as well 
as their manufacturers. This could be the basis for an evaluation that determines precisely 
in which areas there is a need for further development such as the communication or error 
compensation capabilities of autonomous vehicles. On the other hand, it would allow for 
an assessment of how the corresponding legal framework must be designed in order to 
make a functioning “road traffic system” involving autonomous vehicles a reality. 
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26.1 Introduction 


Autonomous vehicles (AVs) hold the promise of saving tens of thousands of lives each 
year in the U.S., and many more worldwide, reducing traffic, saving energy, and providing 
mobility to those who cannot drive conventional cars. Nonetheless, AVs will inevitably 
have some accidents. On balance, AVs are likely to prevent many more accidents than 
they cause, but there will be at least some accidents involving AVs that would not have 
occurred with conventional vehicles. 

Because of accidents involving AVs, some of which may be catastrophic, product 
liability litigation! is inevitable, especially in cases where conventional vehicles would not 
have crashed. The threat of massive product liability litigation involving AVs is widely 
perceived as one of the chief obstacles to AV development and sales, if not the number 
one threat [3].” Some believe that product liability suits are an existential threat to 
autonomous driving [33].° Crippling suits could force manufacturers to exit the market 
and may deter some manufacturers from entering the market because of a belief that the 
sales are not worth the risk. If these dire predictions come to pass, the U.S. and other parts 


'This chapter focuses mainly on product liability litigation, although there are also requirements to 
compel vehicle manufacturers to recall their vehicles to fix defects. The management of liability and 
recall risks overlap and the risk management principles discussed in this chapter apply to both. 
“Some of the largest obstacles to autonomous consumer vehicles are the legalities [2].” Reports 
from Lloyd’s of London and the University of Texas listed product liability as among the top 
obstacles for AVs [21, 30]. 


“T]he worst outcome would be that said liability isn’t sorted out so that we never do get the mass 


manufacturing and adoption of driverless cars” [33]. 
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of the world experiencing a flood of lawsuits may lose the use of a technology that would 
save many times more lives than it would endanger. If, however, the industry finds 
effective ways to manage the risk of product liability, it can bring to market a lifesaving 
technology while maintaining practices to minimize accidents and resulting liability, as 
well as the profitability needed to offer AVs in the market over time. 

The purpose of this chapter is to identify product liability risks in the U.S. to manu- 
facturers of AVs, the source of those risks, and how manufacturers can manage those risks. 
A focus on U.S. product liability is important from a worldwide manufacturer’s per- 
spective given the size of the U.S. market and the perception that the U.S. is a litigious 
country. Product liability is perceived as a greater threat in the U.S. than in any other 
country of the world. Section 26.2 discusses the circumstances giving rise to U.S. product 
liability litigation and the phenomenon of some U.S. cases resulting in huge awards to 
plaintiffs seeking compensation. It explains why these huge awards occur. Section 26.3 
analyzes the human and financial impacts of more recent high profile product liability 
cases. Section 26.4 discusses U.S. product liability law, focusing on the types of claims 
and defenses arising in product liability cases. Section 26.5 covers design practices and 
procedures that manufacturers can use to reduce the risk of product liability. Section 26.6 
examines insurance as a means of shifting and managing product liability risk. Finally, 
Section 26.7 explains other risk management techniques. 


26.2 Why Do Product Liability Suits Occur? 


First and foremost, manufacturers face product liability suits, because their products are 
involved in accidents. From the early days in the development of Anglo-American tort* 
law, the road accident played a prominent role. A key British case in the development of 
U.S. tort law, Winterbottom v. Wright, involved a mail coach driver who was thrown 
from his horse-drawn mail carriage after it broke down, allegedly due to the defendant 
contractor’s failure to maintain the carriage in a safe condition (321° 

Starting in the 20th century, the car accident caused significant changes in U.S. product 
liability law. “Products liability, like America, grew up with the automobile. Prior to the 
entry of motorcars onto the nation’s highways, ‘there simply were not large numbers of 
product-related lawsuits.’ Once America embraced the automobile, it inevitably embraced 


*«Tort” means “wrong,” and “tort law” provides a mechanism for a plaintiff to seek redress in a civil 
(i.e., non-criminal) case. 

°It was common in the 19th century for American courts to cite contemporary British cases as 
precedents. 

°In Winterbottom, the court denied relief to the injured coachman because of a lack of direct 
contractual relationship, called “privity,” between the plaintiff coachman and the defendant 
contractor. The coachman was not a party the contract in which the defendant contractor promised to 
maintain the coach in good working order [32]. 
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automotive products suits as well” [13]. Two of the most significant products liability 
cases in American history arose from auto accidents. In MacPherson v. Buick Motor Co., 
the famous American jurist Benjamin Cardozo writing for the New York Court of Appeals 
upheld a verdict for a car owner ejected from his Buick car after a defective wooden wheel 
on the car collapsed [22].’ In Henningsen v. Bloomfield Motors, Inc. [17],® the New Jersey 
Supreme Court affirmed a jury verdict against Chrysler and a dealer after the wife of the 
purchaser had an accident. She testified that she felt something crack in the car, the 
steering wheel spun sharply, the car veered off the road, and the car struck a highway sign 
and brick wall. 

The threadbare descriptions of the car accidents in these appellate courts’ decisions, 
however, do not reflect the reality of the trial setting in which lawyers for the injured 
plaintiffs will describe what might be a catastrophic car accident in unvarnished and 
sometimes horrific terms. Consider a description of the famous Ford Pinto accident 
written in Mother Jones magazine. Although the description below comes from a writer,” 
it is similar in tone and impact to what a plaintiff’s lawyer might say about his or her client 
in an opening statement. Here is how the writer describes the accident: 


[A] woman, whom for legal reasons we will call Sandra Gillespie, pulled onto a Minneapolis 
highway in her new Ford Pinto. Riding with her was a young boy, whom we’ll call Robbie 
Carlton. As she entered a merge lane, Sandra Gillespie’s car stalled. Another car rear-ended 
hers at an impact speed of 28 miles per hour. The Pinto’s gas tank ruptured. Vapors from it 
mixed quickly with the air in the passenger compartment. A spark ignited the mixture and the 
car exploded in a ball of fire. Sandra died in agony a few hours later in an emergency hospital. 
Her passenger, 13-year-old Robbie Carlton, is still alive; he has just come home from another 
futile operation aimed at grafting a new ear and nose from skin on the few unscarred portions 
of his badly burned body. [11] 


In the courtroom, the young boy, so badly disfigured by the accident, would likely be 
sitting next to his attorney during the entire trial. The jury would be seated facing him, and 
watching him. The unspoken testimony of his catastrophic injuries would likely have at 
least an unconscious effect on the jurors watching him. Despite instructions from the judge 
not to permit sympathy, bias, or prejudice to sway their verdict, a car manufacturer 
defending this case would have an difficult time at trial. In the Ford Pinto case, the 
13-year-old boy, whose real name was Richard Grimshaw, received a jury award in the 
amount of over $2.5 million in compensatory damages and an award of punitive damages 
to punish and deter Ford in the amount of $125 million [15]. Part of the motivation for the 


The plaintiff had bought the car from a retailer, but could still sue the manufacturer despite the lack 
of privity with the manufacturer [22]. The car was apparently going 8 miles per hour at the time of 
the accident [13]. 

The court rejected privity, a warranty disclaimer, and limits of liability as defenses to the warranty 
claim of the wife driver of the car and her husband, the owner [17]. 

°The writer is using pseudonyms for the names of the crash victims, evidently before the names of 
the victims became public. 
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large verdict was evidence during the trial of Ford’s apparently cold-hearted decision not 
to use fairly inexpensive parts in its cars that would have prevented the accident. Although 
the punitive damages award was later reduced in this case to $3.5 million [15], the Ford 
Pinto case shows the kind of award that is possible in an automobile product liability case 
following a catastrophic accident. 

At some future time when an AV manufacturer faces a product liability trial, we can 
expect to see accident victims seated in a courtroom with similar gruesome disfigurements 
and stories of out-of-control cars and tragic, frightful accidents. The defendant manu- 
facturer’s engineering and business practices will come under scrutiny. And a jury will 
likely decide whether or not the manufacturer should be held responsible for the accidents. 

During an AV’s design phase, its manufacturer’s design team will have an opportunity 
to discuss and make engineering and business decisions about the design of its AVs. Team 
members will talk about safety efforts the manufacturer is willing to undertake. In these 
discussions, team members can think more clearly and assess risk more effectively by 
imagining themselves in a courtroom setting, defending their practices in litigation arising 
from a catastrophic accident. 

Why are jurors willing to render these large verdicts against manufacturers? The short 
answer is juror anger. “Angry jurors mean high damages” [24]. More specifically, juries 
render large verdicts when they become angry at defendants’ conduct. When juries 
become angry, the only way that they see they can redress the defendants’ wrongs is to 
render very large verdicts against them in an effort to send a message that their conduct is 
unacceptable. 

In the Ford Pinto case, the jury heard evidence that Ford had known about the problems 
with its fuel system. Ford had found the problem of rear-end crashes splitting open the 
Pinto’s gas tank. In addition, Ford knew that a part costing $11 could have prevented the 
accident. Nonetheless, Ford made a cost/benefit analysis comparing the overall cost of 
adding the safety part to the vehicle against the value of the lives lost from accidents 
involving the vulnerability. Ford assigned a value to each human life likely lost. And Ford 
decided that the overall cost of the part exceeded the overall value of the human lives that 
would be saved and determined that it therefore should not add the part to the Pinto’s 
design. 

Ford’s cost/benefit calculation seemed odious to the jury because it placed a dollar 
value on human life. In addition, the jury knew that the extra part would only cost $11. By 
not adding the part to the Pinto’s design, the jury evidently concluded that Ford placed its 
profits ahead of human life. Ford’s apparent callousness led to the jury anger [15]. 

In another famous product liability case, a Texas lawyer obtained a $253.5 million 
verdict against pharmaceutical company Merck for Carol Ernst, the widow of Robert 
Ernst. Mr. Ernst died after having taken Merck’s painkiller Vioxx for eight months [5]. 
The jury saw internal Merck documents showing that the company was aware of the heart 
attack risk to users before it started marketing the drug. The documents gave the jury the 
impression that the company cared more about profits than public safety. As a result, the 
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jury tried, via the huge award, to send a message that it is wrong to hide information about 
a drug’s danger [14]. Although an appellate court later overturned the jury’s verdict, again 
the case underscores the risk of huge product liability verdicts [23]. 


26.3 More Recent High-Profile Product Liability Litigation 


As noted in the previous section, appellate courts provided some relief to Ford and 
overturned the verdict in the Vioxx case. Nonetheless, manufacturers should look to two 
more recent sets of cases in order to analyze the potential human and financial impact of 
product liability issues. Section 26.3.1 covers the so-called “sudden acceleration” phe- 
nomenon involving Toyota cars. Section 26.3.2 describes the fallout from the General 
Motors ignition switch defects. These two cases show how manufacturers may need to 
pay huge sums to resolve product liability legal proceedings, which are in addition to the 
human toll of deaths and injuries. 


26.3.1 “Sudden Acceleration” Litigation 


Several years ago, news stories emerged concerning a phenomenon in which Toyota 
drivers reported that their cars accelerated without warning and were difficult to stop, 
resulting in accidents. One typical news report stated, “Nancy Bernstein feels lucky to be 
alive after her Toyota Prius kept accelerating, no matter how hard she hit the brakes. ‘The 
car’s going about 70 miles an hour, and I’m beginning to get scared because it’s not 
slowing down,’ Bernstein described” [26]. Lawsuits followed these accidents, and federal 
cases were transferred to the U.S. District Court for the Central District of California for 
coordinated or consolidated pretrial proceedings [27]. 

Some reports contend that the 89 people may have died from accidents involving the 
sudden acceleration of Toyota vehicles [10]. Governmental investigations, however, 
showed no evidence that design or implementation flaws in Toyotas caused unintended 
acceleration [25]. Accordingly, there was some controversy about whether Toyota or 
drivers were at fault in these accidents. 

Later in the litigation, however, a report by expert witness Michael Barr following 
additional research opined that a software malfunction occurred in one of the cars and that 
the malfunction resulted in unintended acceleration [4]. Barr identified numerous alleged 
problems with the software, which according to Barr, Toyota’s own engineers had trouble 
understanding and characterized as “spaghetti like” [4]. Barr testified about his findings in 
an Oklahoma state court case and, apparently based in part on these findings, the jury in 
the case awarded compensatory damages of $1.5 million to the driver and $1.5 million to 
the family of a passenger who died in the crash [35]. The parties in the case, Bookout v. 
Toyota Motor Corp. [7], settled the case right before a second phase of the trial to consider 
punitive damages against Toyota [18]. 
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Despite the uncertainty about what really caused these accidents, Toyota started to 
settle the various legal actions against the company. The Oklahoma case may have been a 
motivating factor [28].'° Toyota’s settlement payments so far include: 


e $1.6 billion to settle financial loss claims in the multidistrict litigation [28]. 

e $1.2 billion to settle potential criminal charges against Toyota [29]. 

e $25.5 million to settle shareholder claims arising the failure to report safety issues [29]. 
e $65 million in fines for violations of federal vehicle safety laws [29]. 


These settlement payouts are in addition to the numerous product liability lawsuits that 
remain pending, the settlement of which presumably will cost a huge sum. If product 
liability settlement amounts exceed $1 billion, then the total settlements may exceed 
$4 billion. The cost of legal fees and other internal expenses related to investigation and 
remedial measures will add even more to the final cost for Toyota. 


26.3.2 General Motors Ignition Switch Issues and Recall 


Another high-profile product liability issue arose from the recently uncovered problem 
with ignition switches in certain General Motors cars. In the late 1990s, GM started using 
new switches for small cars to make them work more smoothly. “But as it turns out, new 
switches in models such as the Chevrolet Cobalt and Saturn Ion can unexpectedly slip 
from ‘run’ to ‘accessory,’ causing engines to stall. That shuts off the power steering, 
making cars harder to control, and disables air bags in crashes [20]. The problem sup- 
posedly caused over 50 accidents. “GM says the problem has caused at least 13 deaths, 
but some members of Congress put the death toll near 100” [20]. 

Apparently, GM engineers were aware of the problem before the accidents, but decided 
not to replace the switches. An internal email uncovered in Congressional hearings dis- 
cussed the fact that a more robust design would add 90 cents to the price of the switch, and 
would only save 10-15 cents in reduced warranty claims [16]. “The part costs less than 
$10 wholesale. The fix takes less than an hour. A mechanic removes a few screws and 
connectors, takes off a plastic shroud, pops in the new switch, and the customer is back on 
the road” [12]. “[T]o many people familiar with the automaker,” the reason GM did not 
recall the cars sooner “is a corporate culture reluctant to pass along bad news. When GM 
was struggling to cut costs and buff its image, a recall of its popular small cars would have 
been a terrible setback” [12]. “It’s pretty clear that somebody somewhere was being 
penny-wise and pound-foolish,’ said Marina Whitman, a professor at the University of 
Michigan and a former economist at GM” [12]. 


10-7 egal analysts said that the verdict most likely spurred Toyota to pursue a broad settlement of its 
remaining cases” [28]. 
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GM’s decision not to recall the cars sooner is proving to be a costly one. Congress, 
safety regulators, the U.S. attorney in New York City, the SEC, Transport Canada, and 45 
state attorneys general are conducting probes of GM. GM is undertaking a costly recall of 
the cars. Also, GM created a compensation fund for families of crash victims, which it 
expects will cost the company $400-$600 million [19]. 


In addition to the compensation fund, GM said that it will spend $1.2 billion to repair the cars 
and trucks recalled during the second quarter, on top of the $1.3 billion it identified for repair 
costs in the first three months of the year. In addition, the company set aside an additional 
$874 million in the quarter for future recalls. [19] 


The total expense for GM will be huge: “All told, GM’s recalls have cost the auto- 
maker nearly $4 billion this year” [19]. Presumably, GM will continue to pay more in 
future years as well. Moreover, GM will have to pay even more for legal fees and other 
internal expenses related to investigation and remedial measures. 


26.4 Claims and Defenses in Product Liability Cases 


Having covered the phenomenon of product liability litigation, the human toll of acci- 
dents, and the large financial risks involved, this section covers what plaintiffs must prove 
in order to prevail in a suit based on an allegedly defective product, as well as what 
defendants must provide in order to assert certain defenses. Typical claims for plaintiffs 
seeking damages for bodily injury or property damage from an accident are “strict product 
liability,” “negligence,” and “breach of warranty.”'' Most of the law governing product 
liability in the U.S. is state law, as opposed to federal law, and laws diverge from state to 
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state. 


26.4.1 Strict Product Liability Claims 


The easiest type of claim for a plaintiff to prove is a so-called “strict product liability” 
claim. A plaintiff can include in the suit almost every business in the chain of distribution 
from raw materials or component part manufacturers to manufacturers of the finished 
product, distributors, and retailers [13]. Strict liability refers to liability for defective 
products without fault on the part of the manufacturer and regardless of whether or not 
there is a contractual relationship between the plaintiff and defendant. Laws vary sig- 
nificantly from state to state, and some states do not even recognize strict liability as a 
viable claim. Nonetheless, most states’ statutory and common law strict liability laws are 


H Another theory of recovery for plaintiffs is fraud, also known as “deceit” or “misrepresentation,” 
and is based on false statements made by the seller about a product. Misrepresentations may be 
intentional, negligent (careless), or innocent. This type of claim, however, is the least used theory of 
recovery in the product liability context [13]. 


560 S.S. Wu 


based on the formulation of strict liability under Section 402A of the Second Restatement 
of Torts 3.” As stated in the Restatement, in order to win a strict liability claim, the 
plaintiff must prove at trial: 


e The defendant sold the product in question, 

e The defendant is in the business of selling this kind of product, 

e The product was defective and unreasonably dangerous at the time it left the defen- 
dant’s hands, 

e The product is expected to and does reach the user or consumer without substantial 
change in the condition in which it is sold, and 

e The defect was the proximate cause of the plaintiff’s injuries [2]. 


The key issue for AV strict liability design defect claims will be whether the vehicle 
was “defective.” A plaintiff may assert that the product was defective in its design, the 
product was defective in the way it was manufactured, and/or that the defendant failed to 
provide adequate warnings or instructions to the users of the product. Of greatest concern 
for AV litigation are design defect and failure to warn claims. 

A plaintiff asserting a design defect would show the existence of a “defect” under the 
applicable state law test. Courts in the U.S. apply one of the following tests: 


e A test based on what an ordinary consumer would expect from a product, typically 
used where the potential for injury is clear to consumers from the nature of the product. 

e The risk-utility balancing test, where the plaintiff contends that the risks from a design 
outweigh the benefits to the consumer or public from a design. 

e The product manufacturer test, which asks whether a reasonably prudent manufacturer 
or seller, aware of the product’s dangerous condition, would not have put the product 
on the market if it had been aware of the product’s condition. 

e A combination test, which may shift the burden of proof to the manufacturer to show a 
lack of defect in certain situations. 

e The ultimate issue approach, in which the jury has the discretion to determine whether 
a design is defective [31]. 


Frequently, a plaintiff asserting a design defect will use expert testimony to explain 
why the defendant’s design is defective and will attempt to prove that an alternative 
design could have prevented the accident. 

In addition to relying on design defects, a plaintiff may also assert a strict liability claim 
based on a “failure to warn” theory. Under this theory, the plaintiff could contend that an 
AV was defective because the defendant failed to provide adequate warnings or instruc- 
tions about the vehicle. The plaintiff would need to prove that the warnings did not 


!2«More than three quarters of American jurisdictions incorporate all or part of this section in their 
own distinct brand of strict liability” [13]. Restatements of law summarize the law applicable field of 
law in the U.S., but do not themselves have the force of law. 
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adequately reduce risks associated with the product or that the instructions were inade- 
quate to tell the user how to use the product. 


26.4.2 Negligence Claims 


As an alternative claim, product liability plaintiffs often include a negligence claim in their 
complaints. The concept of “negligence” refers to careless conduct that falls below the 
standard of conduct to which a hypothetical “reasonable man” would adhere. As with 
strict liability, a plaintiff can assert a negligence claim based on the design of the product, 
the way in which the product was manufactured, or the failure to give adequate warnings 
or instructions. Negligence is a harder claim for a plaintiff than strict liability, because the 
plaintiff must show some degree of fault on the part of the defendant. 
In order to prevail in a negligence claim, the plaintiff must prove: 


e The defendant owed a duty of care to provide a reasonably safe product in terms of 
design or to warn of dangerous defects—meeting a standard of conduct to protect 
others against unreasonable risk, 

e The defendant breached its duty of care by failing to conform the standard of conduct 
required, and 

e The defendant’s conduct proximately caused the plaintiff’s injury [31]. 


26.4.3 Breach of Warranty Claims 


In most states in the U.S., a plaintiff may also include a breach of warranty claim in a 
product liability complaint. Warranties are affirmations or promises concerning a product 
or its performance, features, or characteristics, such as those concerning the safety of a 
product. The basis of a breach of warranty claim is that the seller’s product does not 
perform as promised, or does not have the features or characteristics promised. Design 
defects, manufacturing defects, or failures to warn may all provide the basis for a warranty 
claim. As with strict liability, the question is whether or not the product adheres to the 
promises made, regardless of whether the seller is at fault for the failure to conform to the 
promise. Nonetheless, warranty claims are subject to defenses with various degrees of 
effectiveness, including the historical defense of “privity” (plaintiff’s lack of contractual 
relationship with the defendant), the requirement that the plaintiff provide the seller notice 
of the breach, and the ability for sellers to disclaim warranties [31]. In most U.S. juris- 
dictions, purchasers of a product or their family members can sue companies in the chain 
of distribution under a warranty theory despite the lack of privity [31]. 
In order to assert a breach of warranty claim, a plaintiff must typically prove: 


e The defendant made a warranty, 
e The product did not comply with the warranty at the time of the sale, 
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e The plaintiff’s injury was proximately caused by the defective nature of the product, 
and 
e As a result, the plaintiff suffered damage [31]. 


A warranty claim will typically allege one of three kinds of warranties. “Express 
warranties” are those actually stated by the seller, such as in a sales contract, warranty 
program documentation, advertisements, or sales collateral. They may be written or oral. 
In addition to the express warranties, the law will sometimes recognize two kinds of 
“implied warranties” regarding the sale of consumer products that arise by operation of 
law, as opposed to anything the seller actually said. 

One kind of implied warranty is the “implied warranty of merchantability.” This 
implied warranty requires the seller to make sure the product is fit for the ordinary 
purposes of such product. For instance, a consumer would expect that the head of a 
hammer would not fly off the first time it is used after purchase. This kind of implied 
warranty is the one most likely to be asserted against a seller of an AV in future cases. The 
second typical implied warranty is the “warranty of fitness for a particular purpose.” 
Where the seller knows the particular purpose for which the consumer will use the 
product, and the buyer is relying on the skill and judgment of the seller to select and 
furnish suitable products, the law will recognize an implied warranty that the product will 
be fit for that purpose. For instance, if a truck buyer tells a dealer’s sales representative 
that the buyer seeks a pickup that will be able to tow a trailer through mountainous 
off-road terrain, then the dealer is deemed to have warranted that the truck recommended 
by the sales representative can, in fact, tow the trailer off-road in the mountains. 


26.4.4 Claims Under Consumer Protection Laws 


Plaintiffs sometimes assert product liability claims under various consumer protection 
laws. State laws vary, and some states do not permit these laws to be used for personal 
injuries [1]. They are commonly used when plaintiffs seek redress for alleged economic or 
financial losses, such as the diminution in the value of their products due to the alleged 
defect. Examples include California’s Unfair Competition Law (UCL) [8], False Adver- 
tising Law (FAL) [8], and Consumer Legal Remedies Act (CLRA) [9], as well as 
equivalent laws in other states. Claims under these statutes typically require plaintiffs to 
prove: 


e A violation of the statute occurred. 
e That causes. 
e Injury to a consumer. 


For instance, the UCL prohibits unlawful, unfair, or fraudulent business acts or prac- 
tices. The FAL bars untrue or misleading advertising practices. The CLRA prohibits a list 
of unfair business practices, such as misrepresenting the characteristics and qualities of a 
product. 
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26.4.5 Types of Defects at Issue in Autonomous Vehicle Litigation 


We do not yet have examples of cases filed against AV manufacturers to say what kinds of 
alleged defects will likely result in litigation. Nonetheless, the history of automotive 
litigation, discussions with those in the industry, and judgments about what is likely to 
come suggest that there will be many sources of potential defects that may give rise to 
product liability litigation. AVs will share some of these sources of defects with con- 
ventional vehicles, but some of them will be unique to AVs. The lists of potential defects 
in this section are not meant to be exclusive, and there are many possible sources of 
defects in conventional and autonomous vehicles. 

Some possible design defects'* that AVs will have in common with conventional 
vehicles include: 


e Mechanical or physical defects in various systems of the vehicles or their safety 
equipment, such as the use of materials that are not strong or thick enough,'* or an 
excessively high center of gravity subjecting the vehicle to rollovers. 

e Defects in electrical components or systems other than sensors or control systems for 
autonomous driving, such as the use of wrong kind of components, problems in the 
performance of the components, or the lack of durability of the components. 

e Software!” defects relating to systems other than sensors or control systems for 
autonomous driving, including information security vulnerabilities. 


These defects will occur in both conventional and autonomous vehicles and thus 
existing law and litigation methods would apply to determine a manufacturer’s liability. 

Nonetheless, AVs may experience defects that conventional vehicles do not. Again, 
they may be mechanical, electronic, or software. 


e Mechanical or physical defects in the control systems for autonomous mode or the 
sensors used by the autonomous systems. A simple example would be weak mountings 
for LIDAR sensors which, if they failed, might cause the AV to lose its sensor data 
suddenly and crash. 

e Defects in electrical components for sensors or control systems for autonomous 
driving. 

e Software defects in the sensors or control systems used for autonomous mode. 


The most interesting and perhaps most concerning potential defects are those in the 
software used for autonomous driving. Some examples include: 


13 Another issue for manufacturers of finished products concerns their supply chains. Counterfeit or 
defective components may introduce manufacturing defects into AVs. 

For example, the author was involved in one case in which the plaintiff alleged that the metal in a 
car’s tie rod was not strong enough, the metal fatigue experienced by ordinary wear of the car 
weakened the tie rod, and an accident occurred because metal fatigue caused the tie rod to break. 
‘The “software” involved may be in the form of code built into hardware or firmware. 
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e Designs that depend on inadequate data from sensors, including insufficient amount, 
inaccuracy, deficient precision, or inadequate speed of data input. 

e Inaccurate pattern recognition, such as the AV failing to be able to recognize a 
pedestrian in the road or other upcoming obstacles or hazards. 

e Designs that fail to perform safe ordinary maneuvers such as turns, lane-keeping, 
distance-keeping, and merging. 

e Other problems with autonomous behavior, such as unpredictable changes in speed or 
direction. 

e Deficient collision avoidance algorithms. 

e Information security vulnerabilities. 

e Defects arising from inadequate human-computer coordination. For instance, if an AV 
switches between autonomous and manual mode, the AV must alert the driver before 
switching to manual mode and transition to human control safely. 


Moreover, Chap. 4 discusses design decisions programmers must make when creating 
the logic for an AV to handle the situation of when a collision is imminent and 
unavoidable and there is a choice between striking and harming different persons. For 
instance, an AV may face the dilemma of striking a motorcycle rider wearing a helmet or 
one without a helmet, and a programmer might decide that it is better, if a collision is 
unavoidable, to strike one or the other. If the programmer makes such a decision and 
designs the software to implement that decision, this kind of design decision could be the 
subject of a product liability suit from the person struck by operation of the software. 


26.4.6 Defenses in Product Liability Cases 


Defendants may assert a number of defenses against a product liability case. The most 
common types of defenses relate to the conduct of the plaintiff. In some cases, the 
defendant contends that the plaintiff’s negligent conduct caused or contributed to an 
accident. The viability of a defense based on a plaintiff’s own negligence depends on state 
law and the type of claim, but a defendant may also use it as evidence of a superseding 
cause of an accident. In addition, some accidents occur because a plaintiff misused or 
modified a product. In some cases, a plaintiff is said to have “assumed the risk” of an 
open, obvious hazard, such as the possibility of being struck by a golf ball on the links. 
Finally, a plaintiff may not be able to recover all damages if he or she failed in some way 
to mitigate the damages. 

Many of these defenses may have limited application to persons driving AVs in 
autonomous mode. If the plaintiff was not in control of the vehicle at the time of the 
accident, the plaintiff could not have driven carelessly. Once AVs enter the mass market, a 
seller cannot realistically contend that the plaintiff assumed the risk of driving a vehicle 
using new and untested technology. Nonetheless, it is likely over time that some people 
will modify their AVs or try to abuse the sensors or control systems for fun. In these cases, 
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if an accident occurs, the defendant may point to this conduct as a defense. Moreover, 
defenses based on a plaintiff’s conduct could reduce or bar a plaintiff’s recovery when the 
plaintiff was not a driver of the AV, such as a pedestrian carelessly (or intentionally) 
darting out in front of an AV faster than any human or machine could react. 

The other key defense in AV litigation will likely be a “state of the art” defense to a 
design defect claim. The basis of this defense is that the manufacturer could not have 
produced a safer design at the time of sale because safer designs were not technologically 
feasible then. Such a defense is valid in some states while not in others [13].'° 


26.5 Managing the Risk of Autonomous Vehicle Product 
Liability 


Having covered the nature of product liability, the potentially huge exposure for losses, 
juror anger that leads to huge jury verdicts, and the nature of product liability, I now turn 
to the issue of how manufacturers can manage the risk of product liability litigation." 
First and foremost, managing these risks requires a proactive approach. By planning 
today, manufacturers can be prepared for the inevitable suits later. First, planning can 
enable them to make safer products that are less likely to cause litigation-triggering 
accidents in the first place. Second, by planning ahead, manufacturers can increase their 
chances of winning the cases that accidents do trigger. A proactive approach to design 
safety with a comprehensive risk management program establishes upfront a manufac- 
turer’s commitment to safety. When the inevitable suit happens later, the manufacturer’s 
counsel has a story to tell the jury as to why its products were safe and how the manu- 
facturer cared about safety. 

Second, manufacturers should consider the commitment they make to product safety 
using such a proactive approach. One commentator stated, “The most effective way for 
[counsel for] a corporate defendant to reduce anger toward his or her client is to show all 
the ways that the client went beyond what was required by the law or industry practice” 
[24]. Meeting minimum standards is insufficient because of juror skepticism about the 
rigor of standards set or influenced by industry and because jurors expect corporate clients 
to know more about product safety than a “reasonable person”—the standard for judging 


16 Another typical product liability-specific defense is the economic loss doctrine, which bars product 
liability tort claims where the claimed damages are financial and not for bodily injury or damage to 
property other than the product itself. Moreover, federal law may preempt some state law claims, 
because U.S. federal law trumps state laws inconsistent with it. Also, if a product is meant to be used 
by a “sophisticated user” or provided by a “sophisticated intermediary,” the seller may have a 
defense under certain circumstances, although this defense is unlikely to apply to AVs. Finally, if a 
manufacturer creates a product pursuant to government specification, it may have a “government 
contractor defense.” 

IT speak here of product liability litigation, although the risk management techniques here also 
apply to preventing the need for costly product recalls. 
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the conduct of defendants under the law [24]. “A successful defense can also be supported 
by walking jurors through the relevant manufacturing or decision-making process, 
showing all of the testing, checking, and follow-up actions that were included. Jurors who 
have no familiarity with complex business processes are often impressed with all of the 
thought that went into the process and all of the precautions that were taken” [24]. Even 
though accidents do occur, and in any trial setting an accident or problem did occur, a 
defendant’s proactive approach would show the jury that the manufacturer tried hard to do 
the right thing [24]. Consequently, efforts to go above and beyond the minimum standards 
would diffuse juror anger and mitigate the manufacturer’s risk. 

Third, manufacturers should recognize that risk management is a process that begins 
with a careful risk analysis looking at the types, likelihood, and impact of issues in the 
design of AVs. Once a risk assessment is complete, they can review the results and 
analyze changes in design and engineering practices to address these issues, prioritize 
risks and risk mitigation measures, and implement the prioritized risk mitigation measures 
[34]. In connection with the risk management process, manufacturers can obtain guidance 
from a number of standards bearing on risk management and safety: 


e ISO 31000 “Risk management—Principles and guidelines” (regarding the risk man- 
agement process). 

e Software development guidelines from the Motor Industry Software Reliability 
Association. 

e IEC 61508 Functional safety of electrical/electronic/programmable electronic 
safety-related systems (safety standard for electronic systems and software). 

e ISO 26262 family of “Functional Safety” standards implementing IEC 61508 for the 
functional safety of electronic systems and software for autos. 


While adherence to the principles of international standards does not guarantee that an 
AV manufacturer will avoid liability, adherence to standards bolsters the credibility of a 
manufacturer’s risk management program. Moreover, the standards provide a framework 
by which manufacturers can build a set of controls for their risk management process. 
Consequently, an AV safety program built on international standards lays the foundation 
for a later defense of a manufacturer accused of building an unsafe AV. 

Fourth, AV manufacturers should obtain insurance coverage to manage product lia- 
bility risk. A robust insurance program will permit manufacturers to shift the risk of 
product liability to insurance carriers who will, under issued policies, defend and 
indemnify manufacturers for settlements and judgments paid to resolve third party claims. 
Currently, the insurance industry is just beginning to come to grips with the insurance 
implications of AVs [21]. We can expect to see the insurance industry provide third party 
coverage to manufacturers for accidents, and probably privacy and information security 
risks as well. While the industry has no historical data for an actuarial approach to 
underwriting AV risks, the industry will probably look by analogy to conventional 
vehicles and mobile devices for loss experiences [6]. AV manufacturers can find carriers 
willing to write bespoke policies tailor-made to their needs. Eventually other carriers will 
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enter the market and offer more standardized polices, thereby reducing premium costs to 
manufacturers over the long run. 
Fifth, manufacturers can work together on industry risk management initiatives, such as: 


e Participation in standards efforts to promote safety and security within the industry and 
among component manufacturers; 

e Collaborating with other manufacturers in trade groups and (subject to antitrust con- 
cerns) purchasing consortia; with the purchasing power of larger numbers of manu- 
facturers, the industry may have greater leverage with component manufacturers to 
promote safe design and manufacturing processes; and 

e Participation in information sharing groups that can collaborate to develop best 
practices to improve product safety. 


Sixth, manufacturers can manage the risk of huge jury awards by certain pre-litigation 
strategies. For instance, they may want to engage jury consultants that assist the defense of 
product liability cases to identify risk factors for the manufacturer and the types of conduct 
that trigger juror anger. In addition, manufacturers may want to identify and cultivate a 
group of defense experts they can use to educate jurors about various engineering, 
information technology, and safety considerations. Moreover, counsel for manufacturers 
may want to join specialty bars for defense counsel for purposes of sharing information, 
briefs, and other work product. 

Finally, manufacturers can maximize their success in future product liability trials by 
focusing on effective records and information management (RIM). Effective RIM may 
win cases, while poor RIM may lose cases. Documents and records produced contem- 
poraneously with the management of a safety program can corroborate the testimony of 
witnesses, provide a historical record documenting a manufacturer’s safety efforts, and 
send the message that the manufacturer cares about safety. 


26.6 Conclusions 


One of the top, if not the top, challenge autonomous vehicle manufacturers face is the risk 
of product liability suits and recalls in the wake of accidents resulting in deaths and 
catastrophic injuries. Lawsuits in which manufacturers appear callous, placing profits over 
safety, face the risk of huge liabilities. Recent reports about “sudden acceleration” in 
Toyota cars and problems with General Motors’ ignition switches show that these com- 
panies are paying multiple billions of dollars to resolve legal claims. Plaintiffs have a 
number of claims they can assert against AV manufacturers, although manufacturers may 
have defenses as well. Various kinds of defects may crop up with AVs, although problems 
with software, logic, autonomous behavior, and programmer decisions on AV behavior in 
crashes are top concerns. Nonetheless, manufacturers can manage product liability risk 
through careful planning, a strong commitment to safety, an effective risk management 
process beginning with a thorough risk analysis, adherence to international standards, 
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obtaining robust insurance coverage, collaboration with other manufacturers, pre-litigation 
legal strategies, and effective records and information management practices. In sum, the 
threat of crippling product liability litigation in the United States poses a profound concern 
for manufacturers of autonomous vehicles, but starting proactive engineering design 
strategies for safety risk management and legal strategies to anticipate future litigation 
now can place manufacturers in the best position to maximize product safety and mini- 
mize product liability in upcoming decades. 
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Bryant Walker Smith 


Abstract 

This chapter begins with two fundamental questions: How should risk be allocated in 
the face of significant uncertainty—and who should decide? Its focus on public actors 
reflects the significant role that legislatures, administrative agencies, and courts will 
play in answering these questions, whether through rules, investigations, verdicts, or 
other forms of public regulation. The eight strategies discussed in this chapter would in 
effect regulate that regulation. They seek to ensure that those who are injured can be 
compensated (by expanding public insurance and facilitating private insurance), that 
any prospective rules develop in tandem with the technologies to which they would 
apply (by privileging the concrete and delegating the safety case), that reasonable 
design choices receive sufficient legal support (by limiting the duration of risk and 
excluding the extreme), and that conventional driving is subject to as much scrutiny as 
automated driving (by rejecting the status quo and embracing enterprise liability). 


27.1 Introduction 
27.1.1 In Context 


Two complex and conflicting objectives shape altruistic regulation of human activity: 
maximizing net social good and mitigating incidental individual loss. Eminent domain 
provides a superficially simple example: To build a road that benefits ten thousand people, 
a government evicts— and compensates—the ten people whose homes are in the way. But 
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in many cases, individual loss is not fully compensable, most strikingly when that loss 
involves death: Whatever her actual detriment, a person who dies cannot be “made 
whole.” And indeed, more than 30,000 people lose their lives on US roadways every year 
while more than 300 million obtain some direct or indirect benefit from motorized 
transport. 

The promise that vehicle automation holds for highway safety raises difficult questions 
about regulation’s social and individual objectives. Analyzing either objective requires 
topical and temporal definition of a manageable system in which costs and benefits can be 
identified, valued, and compared. With respect to net social good, what is the statistical 
value of a human life? Is a reduction in organ donations a “cost” of safer highways? Could 
aggressive deployment of particular technologies cause a backlash that ultimately 
undermines safety? Similarly, with respect to individual loss, how should injury or death 
be valued? Should culpability affect compensation? Who is entitled to it? The particular 
answers to these questions may depend on the domain—law, economics, ethics, the social 
sciences—from which they are drawn. 

Vehicle automation exposes tension between the social and individual objectives. 
Externalities frequently accompany innovation: Inventors impose costs that they need not 
or cannot bear and create benefits that they cannot capture. Compensation of incidental 
injury may be one such cost, and socially desirable innovations like automation might be 
subsidized by shielding them from it. Calibrating net social good and individual loss can 
also create moral hazard: Safety might be discounted by innovators who are legally or 
effectively exempt from rules and immunized from lawsuits or by consumers who are 
assured of compensation for injury. 

This tension exists against two related background conditions. The first is a preference 
for the status quo—a tendency that is reflected in administrative law, in tort law, and 
internationally in the precautionary principle. Many vehicle fatalities appear only in local 
obituaries, but a single automated vehicle fatality would end up on national front pages. 
The second is a failure by imperfectly probabilistic humans to accurately perceive risk. 
Drivers who speed around blind corners but fear traveling over bridges demonstrate this 
tendency to underestimate some risks and overestimate others. 

This complex regulatory context leads to two fundamental questions: How should risk 
be allocated in the face of significant uncertainty—and who should decide? The range of 
actors includes the legislative, executive, and judicial branches of national and subnational 
governments, companies, standards organizations, consumers, and the public at large. 
Regulation can be prospective or retrospective, but it cannot be nonexistent: Adminis- 
trative agencies that decline to establish safety requirements for automated vehicles 
merely leave this task to judges and juries after incidents have occurred. 

The consequences of action or inaction are as stark as they are uncertain. Regulatory 
acts or omissions could cost lives in the near term by delaying or raising the price of 
automation technologies [1]. But they could also save lives in the longer term by pro- 
tecting broad classes of innovation from the potential reputational damage that early 
tragedies or controversies could inflict. Charting the currents of abstract social gain and 
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Table 27.1 Potential regulatory strategies 


Ensure sufficient compensation for those who are injured 

Expand public insurance Facilitate private insurance 
Force information-sharing by the private sector to enhance regulation 
Privilege the concrete Delegate the safety case 
Simplify both the technical and the regulatory challenges in coordination 
Limit the duration of risk Exclude the extreme 

Raise the playing field for conventional actors along with automated systems 


Reject the status quo Embrace enterprise liability 


concrete human loss from vehicle automation requires appreciating the risks that regu- 
lation presents as well as those that it addresses. 

This chapter first considers the nature of risk, the nature of regulation, and the chal- 
lenge of regulating—in a broad sense—the increasing automation of motor vehicles. It 
then introduces four pairs of potential strategies to respond to this challenge, as sum- 
marized in Table 27.1. 

These strategies are not exhaustive. They may be unnecessary. And they may be 
insufficient. Some are obvious, some are unconventional, and some may well be both. 
Their purpose is to advance discussion of the proper role of the public sector—legisla- 
tures, administrative agencies, and courts—in addressing automation’s challenges and 
opportunities. 


27.1.2 What Is Risk? 


Risk can mean so many things that, without context, it means not much at all. Broadly, 
“[t]he risk of a particular harm is the product of the probability of that harm and the 
severity of that harm; the risk of an act or omission is the sum of the risks of the particular 
associated harms” [2]. This actual risk, however, is merely theoretical: No actor can 
comprehensively inventory all associated harms or accurately determine their probabilities 
and magnitudes. 

In practice, actual risk is therefore simplified into assessed and perceived risk. Assessed 
risk reflects a methodical attempt to objectively describe all significant harms within a 
defined system; this system might contemplate a broad range of harms, as in the case of an 
environmental impact statement, or a more narrow range, as in the case of a functional 
safety standard focused on physical injury to humans [2]. In contrast, perceived risk 
reflects an individual’s subjective judgment about particular dangers; it may differ con- 
siderably from the assessed risk. 

An internalized risk is one that is borne by the actor who creates it, regardless of 
whether that actor has correctly assessed or perceived that risk. Internalization is central to 
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tort law’s regulatory role: By forcing actors to bear more of the costs of their unreasonably 
dangerous behavior, tort law seeks to deter that behavior. 

The financial risks imposed on these actors, however, are categorically different from 
the physical risks that these actors impose on others. In obligating these actors to pay 
damages to those they have injured, tort law also plays a compensatory role. Nonetheless, 
even if those who are injured succeed in recovering damages, they will still have been 
injured [2]. 

Accordingly, it is important to distinguish between reducing physical risk (a regulatory 
function) and shifting financial risk (a compensatory function). Some of the regulatory 
strategies introduced below may achieve one of these two objectives at the expense of the 
other. 


27.1.3 What Is Regulation? 


Regulation checks and changes behavior. In its narrowest sense, the term refers only to 
rules enacted by an administrative agency. A more useful conception, however, encom- 
passes a broad range of actions, including those illustrated in Fig. 27.1 [3]. 

Regulation can be prospective (forward-looking) or retrospective (backward-looking). 
Prospective actions, shown on the left side, contemplate a generalized risk that has not 
manifested, as in the case of the federal performance requirements governing vehicle 
design. In contrast, retrospective actions, shown on the right side, respond to the real- 
ization of a risk, as in the case of a tort claim by a person injured in a crash. The possibility 
of retrospective regulation, particularly if it is foreseeable, can affect behavior even if the 
risk is never realized. 

Regulation can also be pursued by a public actor or by a private actor. Public actions, 
shown on the top, include typical functions of the state: setting requirements and con- 
ducting investigations. In contrast, private actions, shown on the bottom, generally 


Public 
Performance requirements Criminal/civil sanctions 
Process requirements Regulatory recalls 
Regulatory entry barriers Investigations and hearings 
Prospective Retrospective 
Private standards Tort/warranty claims 
Industry practice Reputation impacts 
Insurance conditions Sales impacts 
Private 


Fig. 27.1 Quadrants of regulation 
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involve relationships among private parties: a consensus among market participants, a 
contract between an insurer and its insured, or the tort duties of a manufacturer to those 
who are injured by its products. 

Although this chapter focuses on public actors, these private relationships remain an 
important tool of public policy. A statutory requirement that drivers obtain sufficient 
insurance, for example, delegates some regulatory power to the private-sector insurance 
companies that then decide, subject to additional public regulation, how much any par- 
ticular driver should be charged. 


27.1.4 The Regulatory Challenge 


For public regulators, the utilitarian challenge is to indirectly maximize net social good 
while indirectly mitigating incidental individual loss. With respect to vehicle automation, 
this means defining an appropriate system in which societal costs and benefits can be 
analyzed [2], checking that the incentives and disincentives for developers of automated 
systems are consistent with that system, reconciling these with the incentives and disin- 
centives for other actors, and ensuring that those who are harmed have appropriate access 
to some means of compensation. 

This chapter outlines four pairs of potential regulatory strategies that could advance 
these goals. Its focus on risk management by public actors complements earlier risk 
management proposals for private actors [4]. These strategies involve ensuring compen- 
sation by expanding public insurance and facilitating private insurance, forcing 
information-sharing by privileging the concrete and delegating the safety case, simplifying 
the problem by limiting the duration of risk and excluding the extreme, and raising the 
playing field by rejecting the status quo and embracing enterprise liability. 


27.2 Ensure Compensation 
27.2.1 Expand Public Insurance 


Insurance can help reduce the financial burden placed on injured individuals and, 
potentially, the compensatory pressure placed on tort law. Ensuring that those who are 
physically injured by automated vehicles are able to recover for their injuries makes the 
occurrence of those injuries, at least from a public policy perspective, more justifiable. If 
the only avenue for that recovery, however, is litigation, product liability law may be 
forced to bend in ways that distort its regulatory function. 

While an expansion of insurance has merit as a standalone initiative, it must be a 
condition of any reasonable proposal to subsidize vehicle automation by limiting tort 
remedies. Reducing a defendant’s liability means reducing an injured individual’s access 
to compensation. It also means depriving that individual of a sanctioned means of 
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recourse: Suing a manufacturer, whatever its inefficiencies, is still preferable to sabotaging 
that company’s products or undertaking other means of private retribution. 


27.2.2 Facilitate Private Insurance 


While private insurers can also provide compensation, their potential role as regulators is 
particularly promising. A well-functioning insurance market can generate useful data and 
desirable incentives. It can reduce uncertainty for those who might be plaintiffs as well as 
for those who are regularly defendants. Take two distinct examples: vehicle insurance and 
product liability insurance. 

In the United States, most drivers and vehicle owners are required to carry insurance for 
harms inflicted with their vehicles. The required coverage varies by state and is generally 
far less than would be necessary to compensate for a serious injury or death; California, for 
example, requires only $15,000 in coverage for injury or death to one person and $30,000 
in coverage for injury or death to more than one person [5]. The companies that offer this 
insurance tend to be subject to complex regulatory regimes that also vary by state; Cali- 
fornia even prescribes the primary factors to be used in pricing such insurance [6]. 

An alternative regime could respond much more flexibly to vehicle automation. 
Increasing and then enforcing insurance requirements could help internalize more crash 
costs, compensate injury more fully, shift some recovery from manufacturers toward 
negligent drivers, and enable consolidation of some product liability claims through 
subrogation. Reducing consumer-facing restrictions on insurers could free these compa- 
nies to better tailor their products to reflect the actual risk posed by particular drivers in 
particular vehicles in particular conditions. This could in turn advantage those automated 
vehicles that actually represent a safety improvement. 

In contrast to drivers, companies are generally not required by law to maintain product 
liability insurance. Indeed, one of the purposes of the corporate form is to protect 
shareholders from liability. Requiring such coverage, however, could provide a check on 
safety by engaging a third-party insurer in a regulatory role: In order to obtain affordable 
coverage—or coverage at all—a manufacturer would need to persuade the insurer that its 
products do not pose unreasonable risk. This would be another way to “delegate the safety 
case,” to quote the section of the same name below. 

The regimes created by Nevada and California to regulate automated vehicles already 
require companies seeking to test their systems on public roads to demonstrate financial 
capacity beyond typical state insurance requirements. California, for example, requires 
$5,000,000 in the form of a certificate of insurance, a certificate of self-insurance, or a 
surety bond [7]. While this approach is promising, these heightened insurance require- 
ments should apply to all vehicles rather than merely to automated vehicles undergoing 
testing. As the section of the same name argues below, such regulation should “raise the 
playing field” for conventional as well as automated vehicles. 
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27.3 Force Information-Sharing 
27.3.1 Privilege the Concrete 


Product development requires understanding, and as necessary shaping, external forces 
like law. If specific legal obligations, restrictions, or liabilities are impeding automated 
vehicle technologies, then would-be developers of those technologies should challenge 
those constraints. In short, they should identify the specific legal changes that they or their 
products require—and support these arguments with concrete data and careful analysis. If 
they do not, policymakers should ask why. 

Although concerns have been raised for decades about the product liability implications 
of increasing vehicle automation [8], automakers tend to refer only broadly, if at all, to this 
potential challenge even as they announce plans to deploy increasingly advanced 
automation features. This apparent disconnect suggests either that the technologies them- 
selves are not as imminent as popularly believed [9] or that the companies pursuing those 
technologies are not as concerned about general product liability as is commonly suggested. 

In contrast, automakers have acted to address a more narrow liability question related 
to the installation or modification of automation systems. Several state legislatures have 
now clarified that, to quote Michigan law [10], manufacturers and subcomponent pro- 
ducers are “not liable and shall be dismissed from any action for alleged damages resulting 
from” such third-party installations or conversions “unless the defect from which the 
damages resulted was present” at the time of manufacture. This provision is largely a 
restatement of common law [9] and, like common law, does not unambiguously con- 
template every potential modification claim.’ 

Notwithstanding this uncertainty, this experience demonstrates that established 
automakers can recognize potential legal issues, propose specific legislative remedies, and 
—with the exception of California [11]—obtain their enactment. To the extent that 
automated vehicles depend on changes to vehicle codes [12], insurance requirements, or 
tules of liability, regulators should expect well-reasoned and well-supported arguments 
from their high-profile developers. 

Relying exclusively on companies to advance specific legal changes, however, can 
tend to preserve the status quo. Unlike conventional cars, low-speed shuttles and delivery 
robots generally have neither existing markets nor established companies to advocate for 
them. As a result, these applications of automation have been largely ignored in recent 
legislative and regulatory initiatives [9]. Accordingly, governments should also consider 
whether a dearth of specific proposals or concrete data can be explained by an inability 
rather than a disinclination to participate in the regulatory process. 


‘Consider two examples. In the first, the manufacturer fails to warn against a foreseeable 
modification of its vehicle; might that failure to warn constitute a “defect from which the damages 
resulted”? In the second, the subcomponent producer designs a sensor that is highly vulnerable to 
hacking; might that security vulnerability constitute a “defect from which the damages resulted”? 
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In a sense, governments should approach policymaking with the same philosophy 
underlying public support of physical infrastructure and scientific research: Initiate what 
the private sector cannot or will not do. Broad mandates or basic conditions may be useful 
in driving or policing innovation, but attempts to closely tailor rules to products that do 
not yet exist could produce law that is premature and prejudicial. 


27.3.2 Delegate the Safety Case 


Vehicle automation is putting state regulators in a difficult position. Prominent examples 
come from Nevada and California, the two states whose departments of motor vehicles 
were directed to quickly enact regulations governing automated vehicles and automated 
driving.” These regulations seek both to provide greater legal certainty to the developers 
of automated systems [13-15] and to restrict unreasonably dangerous products and 
practices [16]. 

Many states, however, already empower regulators to restrict the registration, modi- 
fication, or operation of road vehicles on the basis of safety [12]. A New York statute, for 
example, permits the motor vehicle commissioner to “refuse to register any vehicle or 
class of vehicles for use on the public highways where he determines that the charac- 
teristics of such vehicle or class of vehicles make such vehicle or vehicles unsafe for 
highway operation” [17]. 

Alternative approaches to deploying automation systems, including pilot projects and 
aftermarket modifications, may implicate this authority more quickly than would tradi- 
tional rollouts [9]. Long before the National Highway Traffic Safety Administration 
(NHTSA) promulgates rules for automated vehicles? or even conducts investigations into 
incidents involving them, state regulators may be facing—or at least actively ignoring— 
the question of whether to revoke the registration of a vehicle retrofitted with a novel 
automation system. 

Answering such a question will inevitably frustrate these regulators [15]. There is no 
consensus about how to define, or then how to demonstrate, the appropriate level of safety 
for an automated vehicle or for the human-machine system to which it may belong [18]. 
Moreover, the kind of regulation that is appropriate for an established automaker may 
differ considerably from the kind that is appropriate for a small startup or an individual 
tinkerer [9]. 

Although state vehicle agencies generally lack NHTSA’s technical resources, they may 
have more regulatory flexibility. Federal motor vehicle safety standards (FMVSSs) are 


?Other states have enacted automated driving statutes without expressly requiring this rulemaking. 
3NHTSA has historically promulgated performance standards only for safety technologies that have 
already been widely deployed, although the eventual regulation of vehicle-to-vehicle (V2V) 
communications systems is likely to be an exception. 
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restricted to objective measures and to tests “capable of producing identical results when 
test conditions are exactly duplicated” [19], quoted in [20]. 

In contrast, state agencies may be bound by less demanding requirements of admin- 
istrative process, which may afford them the discretion needed to gradually develop 
consistent practice. Such flexibility could enable regulators to address specific technolo- 
gies without entrenching rules that are likely to become anachronistic and irreconcilable 
with others. 

To this end, “delegating the safety case” would mean requiring the developer of a 
vehicle automation system to publicly make and defend arguments about how well its 
system should perform and how well its system actually performs. In short: 


1. A manufacturer documents its actual and planned product design, testing, and 
monitoring. 

. The manufacturer publicly presents this documentation in the form of a safety case. 

. The regulatory agency and interested parties comment on this safety case. 

. The manufacturer publicly addresses these comments. 

. The agency determines that the manufacturer has presented a reasonable safety case. 

. The manufacturer certifies that its product adheres to its safety case. 

. The manufacturer sells that product. 


NNN FW WN 


This process draws on several existing models, including the type approval (or 
homologation) typical in the European Union and the self-certification prescribed by US 
law. It could accommodate the kind of process standards used in ISO 26262, the kind of 
alternatives discussion characteristic of environmental impact statements, and the kind of 
public dialogue foundational to notice-and-comment rulemaking. 

By encouraging companies to disclose information necessary to their safety case, such 
an approach could help educate regulators and the broader public about the capabilities 
and limitations of these emerging technologies. Although disclosure could justifiably 
concern some developers, this process would not require the disclosure of all information, 
only that which is necessary to demonstrate a reasonable safety case. What is reasonable 
will likely evolve, and this approach could afford companies greater flexibility to make 
nontraditional arguments for the safety of their systems and regulators greater flexibility to 
adapt to changing capabilities. 

Because flexibility can also mean uncertainty, early collaboration between regulators and 
developers may be necessary to avoid all-or-nothing approval decisions at the end of 
product development. Regardless, uncertainty is not a new concern: Whatever clarity that 
the current federal regime offers through self-certification to specific standards is diminished 
by the recalls and lawsuits that can arise years or even decades after a vehicle has been sold. 

Indeed, unlike current federal motor vehicle safety standards, a safety case could 
contemplate the entire product lifecycle. A developer might describe not only the steps it 
had taken to ensure reasonable safety at the time of sale but also the steps it would 
continue to take as it learned more about performance in the field. 
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27.4 Simplify the Problem 
27.4.1 Limit the Duration of Risk 


The potential longevity of any motor vehicle—the “average” age of cars in the United 
States is more than eleven years [21]—can create uncertainty for its manufacturers [4] and 
safety concerns for the public [14]. In 2013, Chrysler reluctantly recalled some Jeeps that 
were twenty years old [22, 23]. More generally, newer vehicles tend to be safer than older 
vehicles; “improvements made after the model year 2000 fleet prevented the crashes of 
700,000 vehicles; prevented or mitigated the injuries of 1 million occupants; and saved 
2000 lives in the 2008 calendar year alone” [24]. 

This uncertainty may be particularly great in the case of automated vehicles [4]. Even 
extensive testing may not capture the full range of scenarios that these vehicles could face. 
Manufacturers may have difficulty predicting “the eventual response of judges, juries, 
regulators, consumers, and the public at large to incidents that will inevitably occur” [1]. 
Regulators may be “concerned that, first, isolated incidents involving these products will 
create feelings of helplessness and panic that unjustifiably stymie their wider adoption and 
that, second, these early products will still be around years later when they are much less 
safe than whatever has become state of the art” [14]. 

A promising response to these challenges is a lifecycle approach to vehicle design that 
seeks to limit the duration of risk. For the private sector, this could entail over-the-air 
updates, end-user license agreements, leasing arrangements, and a variety of other tech- 
nical and legal tools to enable manufacturers to update or even forcibly retire systems in 
which they no longer have confidence [4]. For the public sector, this could mean requiring 
companies to document a strategy and a capacity for monitoring the long-term safety of 
their systems. Such documentation could be a key part of the safety case introduced 
above. 


27.4.2 Exclude the Extreme 


The aphorism that “the perfect is the enemy of the good” [25] is instructive for vehicle 
automation. Demanding perfection may impede the development or deployment of sys- 
tems that, while not perfect, nonetheless represent a significant improvement over con- 
ventional vehicles. Excessive design demands, for example, might preclude an automated 
vehicle that could avoid many of the common errors of human drivers but that could not 
avoid catastrophic multicar freeway pileups to the extent physically possible. In other 
words, it may be prudent to accept some failures in order to expedite larger successes. 
Moreover, attempting to design an automated vehicle to handle every conceivable 
driving scenario may introduce complexity that is poorly understood, unmanageable, and 
ultimately detrimental to safety. Again, for example, designing an automated vehicle to 
rapidly accelerate through a pileup-in-progress might lead to programming oversights that 
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could cause that same vehicle to errantly speed up after entering a closed construction 
zone. Here it may be prudent to accept some failures in order to prevent even more 
catastrophic failures. 

For both of these reasons, early generations of automated vehicles may necessarily 
limit the technical challenges that they attempt to solve. These vehicles might be deployed 
into simplified environments at lower speeds [9]. Or they might continue to rely in part on 
human drivers [26], particularly if those humans are professionals who can be carefully 
trained, closely monitored, and sufficiently incentivized. 

Sound engineering may demand additional limitations. For example, it may be prudent 
to program an automated vehicle to never speed, to always slow to a stop in the event of a 
detected failure, or to always permit human override within a set number of seconds. 
These stylized examples might mean that, in occasional cases, an automated vehicle will 
crash because it has failed to accelerate or because it has stopped or because its human 
driver has made poor decisions while panicking. 

Although these should be primarily technical determinations, law may be able to play a 
supporting role. In some jurisdictions, for example, the plaintiff in a product liability case 
must demonstrate that an alternative product design was available and superior to the one 
alleged to have contributed to her injury. In such a case, it may be appropriate to give 
more weight to counterarguments about the complexity, uncertainty, and delay inherent in 
such designs. 

There are, however, two important cautions. First, for those injuries that do occur, this 
strategy merely shifts more of the risk to those people who have been injured. This 
consequence highlights the need for a sufficient social safety net, whether provided 
through public insurance, private insurance, or another means. Second, codifying a ceiling 
on the performance required could mean calcifying the level of reasonable design for 
technologies that may quickly be capable of much more. 


27.5 Raise the Playing Field 
27.5.1 Reject the Status Quo 


The reality that human drivers often violate rules of the road prompts speculation that 
programming automated vehicles to comply with these rules would reduce their appeal. 
Suggestions for addressing this perceived disadvantage have included expressly permit- 
ting automated vehicles to travel at or above the prevailing traffic speed and delegating 
decisions about speed or aggression to the human users of these vehicles. 

Drivers, however, currently behave in ways that are neither lawful nor reasonable [2]. 
They drive too fast for conditions, they follow other vehicles too closely, and they fail to 
yield the right of way to pedestrians. They drive while intoxicated or distracted. They fail 
to properly maintain their vehicles’ tires, brakes, and lights. These largely unlawful 
behaviors occasionally result in crashes, and those crashes occasionally result in serious 
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injury. This tragic status quo suggests that the current approach to traffic enforcement 
should be reformed rather than transferred to automated vehicles. 

At this early stage in automation, transportation authorities would do better to optimize 
and then enforce rules of the road for all motor vehicles. Increasing the expectations 
placed on human drivers—by cracking down on speeding, texting, drunk driving, and 
other dangerous activities—could increase the appeal of automated vehicles at least as 
much as allowing those automated vehicles to speed. 

Automated enforcement could be a key tool for increasing compliance. Such 
enforcement currently relies both on roadway devices (including speed and red light 
cameras) and on in-vehicle devices (including alcohol locks, speed regulators, and pro- 
prietary data recorders). Private entities such as fleet managers and insurance companies 
already provide some of this enforcement indirectly through private incentives. The 
potential proliferation of outward-facing cameras on vehicles and drones in the air might 
also facilitate increased public and private enforcement of rules of the road. 

Increased enforcement could, on one hand, address equity concerns of discretionary 
enforcement and, on the other hand, raise privacy and liberty concerns. While these are 
important questions, a status quo in which laws are openly flouted even by the officers 
enforcing them is one that begs for reform. 

Indeed, more consistent and comprehensive enforcement could create pressure for a 
careful evaluation of existing law. Better access to and analysis of location-specific 
information about the driving environment (including roadway geometry, pavement, 
traffic, and weather) could enable the precise calibration of dynamic speed limits. These 
dynamic limits might then be communicated to drivers through variable message signs 
and, in the future, vehicle-to-infrastructure communication. 

Because reasonable speed also depends on the driver and her vehicle, posted limits 
might nonetheless have only limited utility. Pursuant to the basic speed law [2], a human 
driver should account for each of these variables implicitly and adjust her speed 
accordingly. Automated vehicles, however, may account for more of these variables 
explicitly—and reasonably. 

Consider, for example, the common requirement that the “driver of a vehicle shall yield 
the right-of-way to a pedestrian crossing the roadway within any marked crosswalk or ... 
unmarked crosswalk at an intersection, except as otherwise provided” [27]. Although 
pedestrians may not create an “immediate hazard” by “suddenly” leaving the curb [27], 
the statutory obligation to yield does suggest one possible bound on vehicle speed. 

Imagine a driver traveling down a typical neighborhood street with a parking lane that 
provides 3 m between her car and the curb, as shown in Fig. 27.2. Assuming that her view 
of the pedestrian is not blocked, what maximum speed will enable this driver to stop for 
any pedestrian who, at a walking speed of 1.4 m/s, steps from the curb into the street? 

Although stopping sight distance depends on several vehicle, environment, and driver 
variables [28], this illustration simplifies these to consider only the driver’s reaction time 
and the friction between the tires and the road surface. An average driver with good tires 
on a flat dry street might achieve a reaction time of 1 s and a subsequent deceleration rate 
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Fig. 27.2 Illustration of vehicle stopping 


of 5 m/s”, which implies a maximum speed of 20 km/h (13 mph).* In contrast, a hypo- 
thetical automated vehicle reacting twice as fast and braking at 7 m/s” could reach a 
maximum speed of about 40 km/h (25 mph),° which is a typical residential speed limit 
today. In other words, if automated vehicles are traveling slowly on a road, perhaps 
conventional vehicles should be traveling even more slowly. 

Reasonable speed is also an answer to some, though not all, of the ethical dilemmas 
popularly raised in the context of automated driving [29, 30]. Positing a choice between 
killing one group of pedestrians and another, for example, fails to account for the pos- 
sibility of negating the dilemma simply by driving more slowly. Slower speeds can 
increase controllability as well as reduce the magnitude of harm. 

Speed is not the only relevant driver action. Tire condition, for example, is an 
important consideration in stopping distance, is at least nominally regulated [31], and yet 
varies widely within the current vehicle fleet. If the hardware on automated vehicles is 
expected to be regularly inspected, so too should the hardware on conventional vehicles. 
Moreover, driving imposes environmental costs that are not internalized by vehicle 
owners and operators [32]. If automated driving proves to be more fuel efficient than 
human driving, a higher fuel tax would also incentivize automation. 

In short, reform should seek to more closely align what is lawful with what is rea- 
sonable and to more closely align actual driver behavior with both [2]. The expectation 
that both automated vehicles and human drivers should behave reasonably is itself rea- 
sonable and ultimately advantageous to automated driving. 


“Initial speed = rate of deceleration * ((pedestrian speed/orthogonal distance from curb to 
car) — reaction time) = (0.5 * 9.8 m/s?) * (((1.4 m/s)/3 m) — 1 s) = 6 m/s = 20 km/h = 13 mph. 
“Initial speed = rate of deceleration * ((pedestrian speed/orthogonal distance from curb to car) — re- 
action time) = (0.7 * 9.8 m/s”) * (((1.4 m/s)/3 m) — 0.5 s) = 11 m/s = 41 km/h = 25 mph. 
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27.5.2 Embrace Enterprise Liability 


Although vehicle automation will change the way some cases are litigated and resolved, 
manufacturers are likely to continue to successfully manage their product liability [1]. 
Uncertainty about liability is probably more of an impediment to product deployment than 
actual exposure to liability—and there are strategies that companies can take to manage 
that uncertainty [4]. 

This confidence, however, is not universal [33]. A more skeptical view even has 
precedent: The National Childhood Vaccine Injury Act of 1986 was passed in response to 
similar concerns that traditional product liability had rendered some vaccines uneconomic 
for their would-be producers. The regime it created “combines procedural and substantive 
limitations on conventional tort remedies with an alternative compensation scheme for 
probable victims of covered vaccines” [4]. 

If product liability exposure does impede the deployment of automated vehicles, a 
similar regime might be an effective response. However, that is by no means the only 
conceivable alternative. 

Rather than limiting liability for the manufacturers of automated systems, courts or 
legislatures could expand liability for everyone else. This is counterintuitive and, as a 
legislative proposal, unlikely to go anywhere. Nonetheless, consider the consequences of 
introducing a system of enterprise liability in which manufacturers are liable for all harm 
associated with their products. In other words, what would be different if automakers 
could be successfully sued for every crash involving their product rather than just the 
small fraction in which a vehicle defect contributed to the injury? 

Some effects would be undesirable. Automakers might outright refuse to sell their 
vehicles in any jurisdiction with enterprise liability. Others would demand higher prices to 
cover their increased costs. This could in turn mean less access for consumers, particularly 
those with limited resources. 

Other effects, however, might arguably be more desirable. No longer would dealers 
simply hand over car keys to new buyers. Instead, manufacturers might require these 
buyers to complete more thorough driver training customized for the particular vehicle. 
Technologies like alcohol-sensing ignition locks and speed regulators might become 
standard. Older vehicles might be promptly removed from roads as safer systems are 
introduced. A notable result could be safer roads. 

Another result could be greater automation: Given the choice between paying for the 
mistakes of their own technologies and paying for the mistakes of their disparate cus- 
tomers, many companies would likely opt for their technology. Automation would 
become a solution to rather than merely a source of litigation. 

Even if pure enterprise liability remains a thought experiment, its principles are evident 
in other areas relevant to automation. Fleet operators are an attractive market for auto- 
mated vehicles in part because they are already liable for injuries caused by the negligence 
of their drivers. Automation may also offer near-term financial or market advantages to 
insurers, which similarly pay for injuries caused by their insured. 
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Table 27.2 Potential regulatory strategies 


Ensure sufficient compensation for those who are injured 

Expand public insurance Facilitate private insurance 
Force information-sharing by the private sector to enhance regulation 
Privilege the concrete Delegate the safety case 
Simplify both the technical and the regulatory challenges in coordination 
Limit the duration of risk Exclude the extreme 

Raise the playing field for conventional actors along with automated systems 


Reject the status quo Embrace enterprise liability 


More broadly, as manufacturers gain and assert more control over the products they 
have sold through technology and contract, they may also incur greater legal obligations 
in tort [4]. These obligations, which might approach enterprise liability without actually 
reaching it, could have a similar effect on design decisions. Eventually, selling a vehicle 
that lacks safety-critical automation features might itself be unreasonable. 


27.6 Conclusion 


This chapter began with two fundamental questions: How should risk be allocated in the 
face of significant uncertainty—and who should decide? Its focus on public actors reflects 
the significant role that legislatures, administrative agencies, and courts will play in 
answering these questions, whether through rules, investigations, verdicts, or other forms 
of public regulation. 

The eight strategies discussed above would in effect regulate that regulation. They seek 
to ensure that those who are injured can be compensated, that any prospective rules 
develop in tandem with the technologies to which they would apply, that reasonable 
design choices receive sufficient legal support, and that conventional driving is subject to 
as much scrutiny as automated driving. Table 27.2 summarizes. 

This focus on public actors does not diminish the important roles that private actors 
play in innovation and in regulation. Indeed, several of the strategies discussed above 
expressly embrace these roles. In this spirit, a challenge for—and to—developers of 
automated systems is to contribute fully and publicly to the broader discussions for which 
these strategies are intended. 


Open Access This chapter is distributed under the terms of the Creative Commons Attribution 4.0 
International License (http://creativecommons.org/licenses/by/4.0/), which permits use, duplication, 
adaptation, distribution and reproduction in any medium or format, as long as you give appropriate credit 
to the original author(s) and the source, a link is provided to the Creative Commons license and any 
changes made are indicated. 
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Development and Approval of Automated 2 8 
Vehicles: Considerations of Technical, 
Legal, and Economic Risks 


Thomas Winkle 


28.1 Introduction 


Sensor technology and data processing are constantly improving in their performance. 
This enables both: continuous further development of driver assistance systems and 
increasing automation of the driving task, right up to self-driving vehicles [1]. 

In the following chapter the author traces the technical improvements in vehicle safety 
over recent decades, factoring in growing consumer expectations. Considering Federal 
Court of Justice rulings on product liability and economic risks, he depicts requirements 
that car manufacturers must meet. For proceedings from the first idea until development to 
sign, he recommends interdisciplinary, harmonized safety and testing procedures. He 
argues for further development of current internationally agreed-upon standards including 
tools, methodological descriptions, simulations, and guiding principles with checklists. 
These will represent and document the practiced state of science and technology, which 
has to be implemented in a technically viable and economically reasonable way. 


28.1.1 Motivation 


In the course of this development, technical, especially electrical/electronic systems and 
software are becoming far more complex in the future. Therefore, safety will be one of the 
key issues in future automobile development and this results in a number of major new 
challenges, especially for car manufacturers and their developers. In particular, changing 
vehicle guidance from being completely human-driven, as it has so far been, to being 
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highly or fully automated, raises fundamental questions regarding responsibility and 
liability. This calls for new approaches—first and foremost new safety and testing con- 
cepts [2]. From the legal point of view, automated vehicles require protective safety 
measures in the development process [3]. The remaining risk must be accepted by users. 
According to a judgment by the German Federal Court of Justice (Bundesgerichtshof, or 
BGH), such vehicles must be possible to construct—within the limits of what is techni- 
cally possible and economically reasonable—according to the respective current 
state-of-the-art, state-of-science, and must enter the market in a suitably sufficient form to 
prevent damage [4]. 


28.1.2 Questions of Increased Automation’s Product Safety 


Media reports on car manufacturers, suppliers and IT companies’ automated research 
vehicles have predicted for years the preparation for the development of self-driving 
vehicles, produced in series. Several things still need to be in place however, before these 
vehicles can be launched on the market. Increasing automation of vehicle guidance calls 
for cutting-edge, highly complex technology. Particularly with the use of 
electric/electronic hard- and software, unforeseeable reactions have to be expected, which 
in the worst cases may even be danger to life and limb. Due to the growing complexity, 
fully automating all driving tasks in driverless vehicles (see [3])—without a human driver 
as a backup—currently involves risks, which are difficult to assess. In addition, there are 
new liability questions and limited tolerance for technical failure. While over 3000 deaths 
in road traffic currently seem to be acceptable to society in Germany, there is likely to be 
zero tolerance for any fatal accident involving presumable technical failure. Although 
automation in driving promises considerable potential safety benefits, the comprehensive 
commercialization of driverless vehicles can only take place when questions surrounding 
who is liable and responsible for damage caused by technological systems have been 
clarified. Acceptance by society may only occur when amongst other things, the benefits 
perceived by the individual clearly exceed the experienced risks. 

An in-depth analysis of automated vehicles’ risks to be considered, based on many 
years’ experience in research and product liability, will provide basics for preparing their 
future series development and commercialization. From this, recommendations for safety 
assessment will be concluded. To date, amongst others, the following questions remain 
unsolved: 


— How safe is safe enough? 

— How is the duty of care assured during development? 

— What requirements need consideration when developing and marketing safe automated 
vehicles? 

— Under what conditions is an automated vehicle considered defective? 
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28.1.3 Technical Continued Development of Assistance 
Systems—New Opportunities and Risks 


From a technical point of view, automated vehicles are presently already able to autono- 
mously take-over all driving tasks in moving traffic. Current series-production vehicles 
with an optimized sensor, computer, and chassis technologies enable assistance systems 
with increasing greater performance. Some of the driver-assistance systems on the market 
today give warning when they recognize dangers in parallel or cross traffic (Lane Departure 
Warning, Collision-, Lane Change-, Night Vision- and Intersection-Assistance). Others 
intervene in the longitudinal and lateral dynamics (e.g. anti-lock braking—ABS, Electronic 
Stability Control—ESC, Adaptive Cruise Contro—ACC). Active parking/steering assis- 
tance systems provide increased convenience by interventions of steering and braking at 
low speeds. These partially automated vehicle systems, with temporary longitudinal and 
lateral assistance, are currently offered for series-production vehicles, but exclusively on 
the basis of an attentive driver being able to control the vehicle. Supervision by a human 
driver is required. During normal operation at and beyond the system limits, the system 
limits or failures of these Advanced Driver Assistance Systems, or ADAS, are thus 
compensated by the proof of controllability due to the driver (see [5, 6]). 

For fully automated driving on the other hand, the driver is no longer available as a 
backup for the technical limits and failures. This replacing of humans, acting by their own 
responsibility, with programmed machines goes along with technical and legal risks, as 
well as challenges for product safety. However, future expectations regarding driverless 
vehicles—even in a situation of possible radical change—can only be described as using 
previous experience. Analogies based on past and present expectations concerning vehicle 
safety will therefore be examined in the following section. 


28.2 Expectations Regarding Safety of Complex Vehicle 
Technology 


28.2.1 Rising Consumer Expectations for Vehicle Safety 


Fully automated vehicles must be measured against today’s globally high level of consumer 
awareness in vehicles’ failures. Since 1965, critical awareness regarding the car industry has 
evolved more and more, strengthened by the book Unsafe at Any Speed—The Designed-In 
Dangers of the American Automobile [7, 8]. In this publication, the author Ralph Nader 
blamed car makers for cost savings and duty-of-care breaches at the expense of safe con- 
struction and production. With its presentation of safety and construction deficiencies at 
General Motors and other manufacturers, the book’s content scared the public. Nader went 
on to found the Center for Study of Responsive Law, which launched campaigns against the 
“Big Three” automobile manufacturers in North America, Volkswagen and other car 
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companies. Technical concepts were subsequently reworked and optimized. At the center of 
Nader’s criticism was the Chevrolet Corvair. Amongst other things, Nader criticized the 
unsafe vehicle dynamics resulting from the rear-mounted engine and swing axle. Under 
compression or extension, it changed the camber (inclination from the vertical axis). By a 
design modification into an elastokinematic twist-beam or a multilink rear suspension, the 
inclination remains largely unchanged, which results in more stable driveability and han- 
dling. Later, the VW Beetle also came under fire for similar reasons due to its sensitivity to 
crosswinds. It was also designed with a rear-mounted engine and a swing axle. As a technical 
improvement VW therefore replaced the Beetle with the Golf, with a front engine, 
front-wheel drive and more stable handling (market introduction 1974). 

Besides the development of new vehicles that were of better design and drove more 
safely, a further consequence of this criticism was the establishment of the US National 
Highway Traffic Safety Administration (NHTSA), located within the Department of 
Transportation. Based on the Highway Safety Act of 1970, it improves road traffic safety. 
It sees its task as protecting human life, preventing injury, and reducing accidents. Fur- 
thermore, it provides consumers with vehicle-specific safety information that had previ- 
ously been inaccessible to the public. Moreover, the NHTSA accompanies numerous 
investigations of automobile safety systems to this day. Amongst other things, it has 
actively promoted the compulsory introduction of Electronic Stability Control (ESC). 
Parallel to NHTSA activities, statistics from the German Federal Motor Transport 
Authority (Kraftfahrt-Bundesamt, or KBA) also show increasingly sensitive ways in 
handling safety-related defects, by supporting and enforcing product recalls [9]. Fur- 
thermore, there are now extremely high expectations for vehicle safety. This also can be 
seen in the extensive safety equipment expected today in almost every series production 
vehicle across the globe. It includes anti-lock braking (ABS), airbags, and Electronic 
Stability Control (ESC). The frequency of product recalls has increased, despite passenger 
vehicles’ general reliability and functional safety noticeably rising at the same time. 
Endurance tests in trade magazines such as Auto Motor und Sport show that a distance of 
100,000 km can be obtained more often without any breakdowns, unscheduled time in the 
garage, or defective parts, and without any defect. 


28.2.2 Risks and Benefits of Automated Vehicles 


Automated vehicles will arguably only gain acceptance within society when the perceived 
benefit (depending on the degree of efficiency: “driver” versus “robot”) outweighs the 
expected risks (depending on the degree of automation: “area of action” versus “area of 
effectiveness”). In order to minimize the risks, manufacturers carry out accident-data 
analysis and corresponding risk management (see Fig. 28.1). 
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Fig. 28.1 Societal and individual user acceptance may occur contextually, while consumers weigh up 
the perceived beneficial options and fear for risks in the relevant contexts (see Chaps. 29, 30). Risks 
depend on the level of automation, benefits of the degree in efficiency. Risk management and accident 
data analysis (see Chap. 17) allow for objectivities (see Chap. 30) and optimization. Image rights: Autor 


For car manufacturers and their suppliers, automated vehicles are an interesting product 
innovation with new marketing possibilities. Investment decisions and market launches 
however involve risks that are difficult to assess: 


— What risks exist for product liability claims when autonomous vehicles do not meet the 
requirements of a safe product? 

— Which failures may lead to product recalls? 

— Will the brand image be sustainably damaged if the automated vehicle does not 
comply with consumer expectations? 


28.3 Legal Requirements and Effects 


Society’s and individual expectations of technical perfection in vehicles are rising. Higher 
demands in vehicle quality and functions also call for corresponding safety measures when 
rolling out automated vehicles. This for example can be seen in the increase of recall 
campaigns despite increasing technical vehicle-reliability or additional requirements and 
standards. Applicable comprehensive safety campaigns, such as the Motor Vehicle Safety 
Defects and Recalls or new obligations for documentation by public authorities also indicate 
increasing requirements. One example of the latter is the Transportation Recall Enhance- 
ment, Accountability and Documentation (TREAD) Act in the USA [10], which introduced 
a series of new and extensive obligations for documentation and report-keeping for the 
National Highway Traffic Safety Administration (NHTSA). At the same time, human errors 
in road traffic are sanctioned individually, without bringing the whole road transport system 
itself into question. 

Highly complex technologies and varying definitions slow down any launch of auton- 
omous vehicles. In addition, the interdisciplinary context contains various technical 
guidelines. Developers used to be able to get their specifications with standards or guidelines 
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such as “generally accepted good engineering practice”, “generally recognized and legally 
binding codes of practice”, “industry standards”, or the “state of the art.” With its decision of 
06/16/2009, the German Federal Supreme Court of Justice (BGH) wanted to ramp up 
requirements for the automotive industry and surprisingly shaped the term “latest state of the 
art and science”. This creates additional challenges for developers. Functions that are cur- 
rently feasible in research vehicles for scientific purposes are under laboratory conditions far 
from fulfilling expectations for series production vehicles, e.g. protection from cold, heat, 
vibrations, water, or dirt. 

From a developer’s point of view, these legal requirements for a careful development 
of new complex systems can only be fulfilled after validation tests. These should ideally 
be internationally harmonized and standardized. The German BGH judgment from 2009 
explained these development requirements—excluding economic and technical suitability 
for production—with “... all possible design precautions for safety ...” based on 
“state-of-the-art and science” [4] on the basis of an expert opinion for the preservation of 
evidence. This opinion, however, requires ultrasound sensors as redundancy for recog- 


nition of critical objects to trigger airbags. It should be possible, “... to attach ultrasound 
sensors around the vehicle which sense contact with an object and are in addition verified 
by existing sensors before airbag deployment ...” [4]. 


This expert opinion for the preservation of evidence however from an engineering 
point of view is more than questionable, as current sensor designs only permit a range of a 
few meters in series production vehicles. Subject to the current state of the art, the 
application of ultrasonic sensor systems is limited to detecting static surroundings at slow 
speeds in the scope of parking assistance. The sensors’ high-frequency sound waves can 
be disturbed by other high frequency acoustic sources such as jackhammers or trucks and 
buses’ pneumatic brakes, which can lead to false detections. Also poorly reflecting sur- 
faces will not lead to a reflection of sound waves. Object recognition is then entirely 
excluded [11]. Furthermore, the lawsuit finally concluded that the sensor system con- 
cerned worked error-free according to the technical specification. 

In addition, the previous fundamental BGH judgment requires that risks and benefits be 
assessed before market launch: 


Safety measures are required which are feasible to design according to the state of the art and 
science at the time of placing the product on the market ... and in a suitable and sufficient 
form to prevent damage. If certain risks associated with the use of the product cannot be 
avoided according to state of the art and science, then it must be verified - by weighing up the 
risks, the probability of realization, along with the product benefits connected — whether the 
dangerous product can be placed on the market at all. [4] 


28.3.1 Generally Accepted Rules of Technology 


An interpretation of the term “generally accepted rules of technology” (allgemein 
anerkannte Regeln der Technik, or aaRdT) as a basic rule was shaped in a German 
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Imperial Court of Justice (Reichsgericht) judgment from 1910 based on a decision from 
1891 during criminal proceedings concerning Section 330 of the German Penal Code (§ 
330 StGB) in the context of building law: 


Generally accepted rules of technology are addressed as those, resulting from the sum of all 
experience in the technical field, which have been proven in use, and wherever correctness 
experts in the field are convinced. 


In various legal areas, they have different meanings. In terms of product liability, 
generally accepted rules of technology concern minimum requirements. Noncompliance 
to the rules would indicate the required safety has not been reached. They are described in 
DIN-VDE regulations, DIN standards, accident prevention regulations, and VDI guide- 
lines, amongst others [12]. 


28.3.2 The Product Safety Law (ProdSG) 


The German Product Safety Law (Produktsicherheitsgesetz, or ProdSG), in its revised 
version of 11/08/2011 establishes rules on safety requirements and consumer products. Its 
predecessor was the Equipment and Product Safety Law (Geräte- und Produktsicher- 
heitsgesetz, or GPSG) of 01.05.2004, which in turn had replaced the Product Safety Law 
(Produktsicherheitsgesetz, or ProdSG) of 22.04.1997 and the Equipment Safety Law 
(Gerätesicherheitsgesetz, GSG) of 24.06.1968. Section 3 GSG it describes the general 
requirements for providing products on the market: 


A product may ... only be placed on the market if its intended or foreseeable use does not 
endanger the health and safety of persons. [13] 


28.3.3 The Product Liability Law (ProdHaftG) 


Independent of its legal basis for a claim, the term “product liability” commonly refers to a 
manufacturer’s legal liability for damages arising from a defective product. A manufac- 
turer is whoever has produced a final product, acomponent product, a raw material, or has 
attached its name or brand name to a product. For product liability in Germany, there are 
two separate foundations for claims. The first basis is fault based liability, as found in 
Section 823 of the German Civil Code (BGB) [13]; the second is strict liability regardless 
of negligence or fault related to the tortfeasor, as contained in the Product Liability Law. 
Section 1 of the Product Liability Law (ProdHaftG—Law Concerning Liability for 
Defective Products) of 12/15/1989 describes the consequences of fault as: 


If a person is killed or his or her body or health injured, or if property is damaged, due to a 
defect of a product, the manufacturer of the product is thus obliged to compensate the injured 
parties for any losses. [14] 
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Independently of whether the product defect is caused intentionally or through negli- 
gence, a defect is defined in Section 3 of ProdHaftG as follows: 


A product is defective when it is lacking safety which the public at large is entitled to expect, 
taking into account the presentation of the product, the reasonably expected use of the product 
and the time when the product was put into circulation. [14] 


Should damage arise from a defective product, the Product Liability Law regulates the 
liability of the manufacturer. Firstly, this entails potential claims of civil liability for 
property damage, financial losses, personal injury, or compensation for pain and suffering. 
Liability rests primarily with the manufacturer. In justified cases suppliers, importers, 
distributors, and vendors may also be made liable without limitation. Furthermore, in 
cases of legally founded criminal liability, there may also be particular consequences for 
top management or individual employees, if it is proven that risks were not minimized to 
an acceptable level (see Fig. 28.3). In cases of serious fault or depending on the offense as 
negligence, this may involve criminal personal proceedings against a developer. 

Besides the potential legal consequences, manufacturers must also expect considerable 
negative economic effects. Negative headlines in the media can lead to substantial loss in 
profits or revenue, damage to image, loss in trust and consequently loss of market share. 
Therefore, when developing new systems, both consequences of potentially legal and 
economic risks must be considered. Figure 28.2 gives an overview of the potential effects 
of failures in automated vehicles. 
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Fig. 28.2 Potential effects of failures in automated vehicles. Image rights: Author 
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28.4 Product Safety Enhancement in Automated Vehicles 
Based on Expert Knowledge from Liability and Warranty 
Claims 


28.4.1 Experience from Product Crises 


In the future, safe automated vehicles will further depend on integrated quality manage- 
ment systems [15, 16] and safe interactions [17]. In the past, advanced and successful 
vehicles were frequently affected by product crises. 


28.4.1.1 Defective Supplier Parts and -Systems 
The following examples document how supplier parts and -systems triggered extensive 
product crises. 

The Ford Explorer was the worldwide best-selling sports utility vehicle. In the USA in 
May 2000, the NHTSA contacted both the Ford and Firestone companies due to a con- 
spicuously high rate of tires failing with tread separation. Ford Explorers, Mercury 
Mountaineers, and Mazda Navajos were affected. All were factory-fitted with Firestone 
tires. At high speeds, tire failures led to vehicles skidding out of control and rollover 
crashes with fatal consequences. Firestone tires on Ford Explorers were linked to over 200 
fatalities in the USA and more than 60 in Venezuela. Ford and Firestone paid 7.85 million 
dollars in court settlements. Overall compensation and penalties in total amounted to 
369 million dollars. In addition to recalling several million tires at great expense, com- 
munication errors were made during the crisis: the managers responsible publicly blamed 
each other. This shattered friendly business relations between the two companies that 
dated back over 100 years. Harvey Firestone had sold Henry Ford tires for the production 
of his first car as long ago as 1895. As the crisis progressed it led to serious damage to the 
companies’ images, with sales collapsing for both parties [18]. 

General Motors (GM) announced a further example of defective supplier parts in 
February 2014. As a consequence of the financial crisis, the car company had been on the 
brink of bankruptcy in 2009. It returned to profit for the first time, and won awards for its 
new models, after a government bailout. But the ignition switches on some models had 
seemingly been too weakly constructed since 2001, which meant the ignition key 
sometimes jumped back to the “Off” position while driving. When this happened, not only 
did the motor switch off, but the brake booster, power steering, and airbags also became 
deactivated. GM engineers were accused of having ignored the safety defect in spite of 
early warnings for more than ten years. The company has therefore already been fined 35 
million dollars for a delayed recall and now faces billions of dollars of damages claims 
from accident victims and vehicle owners after mass product recalls [19]. 

Another huge airbag recall campaign by NHTSA involved 11 different vehicle manu- 
facturers and more than 30 million vehicles only in the United States. Airbag Inflators 
supplied by Takata ignited with explosive force. The inflator housing in some cases under 
persistent high humidity as well as high temperature conditions could rupture with metal 
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shards spraying throughout the passenger cabin and injured or killed car occupants. Several 
fatalities and more than 100 injuries have been linked to this case which imposed a record 
civil penalty of 200 million dollar. The airbags were installed worldwide in vehicles from 
model year 2002 through 2015. Despite these injury risks the Department of Transportation 
estimated that between 1987 and 2012 frontal airbags have saved 37,000 lives [20]. 


28.4.1.2 Alleged Sudden Unintended Accelerating or Decelerating 
Vehicles 

Vehicles that automatically intervene in longitudinal and lateral guidance hold consid- 
erable risks and provide a target for those who assert that vehicles steer, accelerate and 
decelerate in unintended, unexpected or uncontrolled ways. The accusation of unintended 
acceleration due to alleged technical defects has already found some car manufacturers in 
the media’s crossfire. Mainly in the USA, vehicles with automatic transmission are said to 
have accelerated in an unintended manner by themselves, causing fatal accidents. Affected 
drivers have initiated waves of lawsuits lasting for decades. 

One example of this were the accusations against Toyota, a globally successful 
company known for quality. Toyota came off very well in customer-satisfaction studies by 
the American market research firm J. D. Power and Associates in 2002, 2004, and 2005. 
In 2009, however, it faced accusations of alleged, unintended and sudden accelerating 
vehicles. These were initially triggered by single incidents of sliding floor mats, which had 
supposedly been responsible for gas pedals getting jammed. It was then argued that 
vehicles would have accelerated unintentionally while driving due to the mechanically 
jammed gas pedals. As Toyota had not responded to the allegations quickly enough in the 
eyes of the NHTSA, the company was accused of covering up safety problems linked with 
more than 50 deaths. As well as compensation payments, Toyota had to pay the authority 
penalties of 66.15 million dollars. This was followed by extensive product recalls, claims 
for damages and a record 1.2 billion dollar criminal penalty [21]. 

A further instance of a proven technical defect that led to unwanted accelerations can 
be seen in an NHTSA recall action in June 2014. The software problem occurred in some 
Chrysler Sport Utility Vehicles (SUV). When optional adaptive cruise control was acti- 
vated and the driver temporarily pressed the accelerator pedal to increase (override) 
vehicle’s set speed more than the cruise control system would on its own, the vehicle 
could continue to accelerate briefly after the accelerator pedal was released again. In this 
case and according to technical requirements the vehicle has to decelerate to the requested 
set speed. There were no accident victims to lament. The short-notice initiated recall was 
restricted to a mere 6042 vehicles [22]. 

Other great challenges already occurred because autonomous braking systems decel- 
erated in some individual cases without a visible reason for the driver and put vehicles at 
risk of a rear-end collisions. However, automatic braking and collision warning systems 
have great potential in reducing road accidents and saving lives. After recognizing a 
relevant crash object they can automatically apply the brakes faster than humans, slowing 
the vehicle to reduce damage and injuries. Therefore these systems are recommended to 


28 Development and Approval of Automated Vehicles ... 599 


be made standard equipment on all new cars and commercial trucks. Since November 
2013 EU legislation has mandated Autonomous Emergency Braking Systems (AEBS) in 
different stages with respect to type-approval requirement levels for certain categories of 
motor vehicles to cover almost all new vehicles in the future [23]. 

According to NHTSA, the Japanese car manufacturer Honda Motor Company had to 
recall certain model year 2014-2015 Acura vehicles with Emergency Braking. The reason 
was that the Collision Mitigation Braking System (CMBS) may inappropriately interpret 
certain roadside infrastructure such as iron fences or metal guardrails as obstacles and 
unexpectedly apply the brakes [24]. Furthermore NHTSA investigated complaints 
alleging unexpected braking incidents of the autonomous braking system in Jeep Grand 
Cherokee vehicles with no visible objects on the road [25]. 

Another recall of Chrysler vehicles from 2015 July 24 was, in accordance with NHTSA 
the first, caused by a software hack. US researchers brought a moving Chrysler Jeep under 
their control from afar, which forced the company to recall and ensure cyber-security of 
their onboard software. The affected vehicles were equipped with Uconnect radio enter- 
tainment systems from Harman International Industries. Software vulnerabilities could 
allow third-party access to certain networked vehicle control systems via internet. 
Exploitation of the software vulnerability could result in unauthorized manipulation and 
remote control of certain safety related vehicle functions—such as engine, transmission, 
brakes and steering— resulting in the risk of a crash [26]. 

In addition to the increase of recall actions the costs for penalties have increased 
significantly. In 2014 alone, NHTSA issued more than 126 million dollars in civil 
penalties, exceeding the total amount collected by the agency during its forty-three year 
history. 

Many new technological risks for automated functions in future may not be visible 
during development and testing. These issues arise in real-life traffic situations and 
developers have to make necessary changes to the technology ensuring real world traffic 
safety (see Sect. 28.4.7). 


28.4.2 Essential Questions from Previous Product Liability Cases 


The author’s own experience of previous product liability cases has shown that inter- 
disciplinary structured development is a minimum requirement, especially for safe auto- 
mated vehicles (see Sect. 28.4.6). In case of damage, the following questions are the key 
for avoiding civil and criminal claims: 


— Before developing a new product, has it already been checked for potential faults— 
under consideration of the risks, the likelihood of their occurrence, and the benefits— 
whether the vehicle can be type-approved to be licensed for road traffic use in the 
intended technological specification? 
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Essentially, besides general type approval requirements, no globally agreed upon and 
harmonized methods for fully automated vehicles exist today. These can be generated 
using international legally binding development guidelines with checklists—similar to the 
RESPONSE 3—ADAS Code of Practice for the Design and Evaluation of Advanced 
Driver Assistance Systems (“ADAS with active support for lateral and/or longitudinal 
control”) [5] linked to ISO 26262 [27] (Section 3, Concept phase, Page 24, 
Controllability): 


— What measures beyond purely legal framework were taken to minimize risk, damage, 
and hazards? 


Future guidelines will either be orientated towards today’s requirements or to a large 
extend adopt them. The methods for evaluating risk during development (see Sect. 28.4.4) 
ensure that no unacceptable personal dangers are to be expected when using the vehicle. 
Therefore the general legally valid requirements, guidelines, standards and procedures 
during the development process must at the very least, take into consideration as a 
minimum requirement: 


— Were generally accepted rules, standards, and technical regulations fulfilled? 


Only complying with current guidelines is usually insufficient. Furthermore it raises the 
following questions: 


— Was the system developed, produced, and sold with the required necessary care? 

— Could the damage that occurred have been avoided or reduced in its effect with a 
different design? 

— How do competitors’ vehicles behave, or how would they have behaved? 

— Would warnings have been able to prevent the damage? 

— Were warnings in the user manuals sufficient or additional measures required? 


Whether an automated vehicle has achieved the required level of safety or not can be 
seen at the end of the development process: 


— Was a reasonable level of safety achieved with appropriate and sufficient measures in 
line with state of the art and science at the time it was placed on the market? 


Even after a successful market introduction, monitoring of operation is absolutely 
necessary. This is still the case when all legal requirements, guidelines, and quality 
processes for potential malfunctions and safe use of the developed automated vehicle 
functions have been complied with. The duty to monitor is the result of the legal duty to 
maintain safety as found in Section 823 Paragraph 1 of the German Civil Code 
(BGB) [13], where breach of duty triggers liability for any defect that should have been 
recognized as such. This raises the concluding question for product liability cases: 


— Was or is the automated vehicle being monitored during customer use? 
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28.4.3 Potential Hazard Situations at the Beginning 
of Development 


The day-to-day experience of our technologically advanced society shows: risks and risky 
behavior are an unavoidable part of life. Uncertainty and imponderables are no longer 
seen as fateful acceptable events but rather as more or less calculable uncertainties [28]. 
The result of this are higher demands referring to risk management for the producers of 
new technologies. 

A structured analysis of the hazards in consideration of all possible circumstances can 
help to give an initial overview of potential dangers. Therefore, in the early development 
stages it makes sense to provide a complete specification of the automated vehicle, to 
ensure a logical hazard analysis and subsequent risk classification (see Sect. 28.4.4). 

On this basis, it is possible for an interdisciplinary expert team (see Fig. 28.6) to draw 
up a list of well-known potentially dangerous situations at the start of a project. This 
usually leads to a large number of relevant situations. Due to practical considerations, 
scenarios for expert assessment and testing should later be restricted to the most relevant 
(e.g. worldwide relevant test scenarios based on comprehensively linked up geographi- 
cally defined accident-, traffic-flow- and weather data collections, see Chap. 17). 

According to the system definition, it is recommended to initially gather situations in a 
list or table. This should take the following into consideration: 


— When should the automated function be reliably assured (normal function)? 

— In what situations could automation be used in ways for which it is not designed for 
(misinterpretation and potential misuse)? 

— When are the performance limits for the required redundancy reached? 

— Are dangerous situations caused by malfunctioning automation (failure, breakdown)? 


Jointly drawing up a maximum number of dangerous situations relevant to the system 
makes it likely that no potential major hazard is omitted or forgotten. Summarizing the 
hazards with direct impact on safety is recommended as a next step. After cutting the 
situations down to those that are actually safety-relevant, will technical solutions then be 
developed. 


28.4.4 Methods for Assessing Risks During Development 


In discussing phasing out nuclear energy, a German Federal Government publication 
states that German society—as a “community with a common destiny” and as part of the 
“global community of risk”—wishes for progress and prosperity, but only accompanied 
by controllable risks [29]. This is surely only partially transferable to road traffic, where 
risks of automated vehicles are limited—in contrast to nuclear energy - to a manageable 
group of people. However, the specific requirements for the methods used in analyzing 
and assessing risks are similar. Five common methods are outlined below. 
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28.4.4.1 Hazard Analysis and Risk Assessment 
The hazard-analysis and risk-assessment procedure (H&R) is described and annotated in 
ISO 26262 Part 3 for functional safety of complex electrical/electronic vehicle systems as 
well as in the related ADAS Code of Practice for the development of active longitudinal 
and lateral functions (referenced in ISO 26262-3, Concept phase) [5, 6]. Parts of the 
methods given as examples in the following section (HAZOP, FMEA, FTA, HIL) also 
point to the H&R. Aim of H&R is to identify the potential hazards of a considered unit, to 
classify them, and set targets. This will enable dangers to be avoided, thus achieving a 
generally acceptable level of risk. In addition, an “item” is judged on its impact on safety 
and categorized to an Automotive Safety Integrity Level (ASIL). An “item” is defined in 
ISO 26262 as a complex electrical/electronic system or a function that may contain 
mechanical components of various technologies. The ASIL is ascertained through a 
systematic analysis of possible hazardous situations and operating conditions. It also 
involves an assessment of accident severity levels via Abbreviated Injury Scale (AIS) [30] 
in connection with the probability of occurrence. A reduction to an assumed hardware 
mean safety failure rate, e.g. ASIL D: < 1078 h™', for a social and individual accepted risk 
(see Fig. 28.3) is achieved with external measures [27]. 

Basically, risk R can be expressed for an analytical approach as function F of the 
frequency f with which a hazardous event occurs, and the potential severity of harm S of 
the resulting damage: 


R=F(f,S) (28.1) 
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Fig. 28.3 Measures to increase safety for social and individual accepted risks. Image rights: Author 
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The frequency f with which a hazardous event occurs is in turn influenced by various 
parameters. One essential factor to consider is how often or how long a person is in a 
situation where a hazard can occur (E = exposure). Another influence on whether a 
hazardous event occurs, is if individuals and road users involved in the accident can react 
with timely response, preventing potentially damaging effects (C = controllability). 
Controllability via the driver, however, is not present in case of driverless and fully 
automated vehicles participating in an accident. The product Æ X C is a measure of the 
probability that a defect has the potential in a certain situation to have a corresponding 
impact on the damage described. 

A further factor (A = failure rate) can be traced back to undetected random hardware 
failures of system components and dangerous systematic errors remaining in the system. It 
gives the frequency of occurrence with regard to E with which the automated vehicle can 
trigger a hazardous event itself. The product f thus describes the number of events to be 
expected during period E, e.g. kilometers driven or the number of times a vehicle is started. 


f=Exh (28.2) 


Furthermore, ISO 26262 stipulates that the Failure in Time (FIT) of technical and 
electronic components must also be considered. The unit FIT gives the number of com- 
ponents that fail within 10° h. 


1 fail 
1 FIT = ankak - (28.3) 
10° hours of device operation 


Probability of occurrence f and—where possible—controllability C give the Auto- 
motive Safety Integrity Levels: either ASIL rating into B, C (a recommended probability 
of occurrence lower than 10°” h ', corresponding to a rate of 100 FIT) or D (required 
probability of occurrence smaller than 1078 h ' corresponding to a rate of 10 FIT). The 
highest requirements are thus for ASIL D. Besides normal vehicle operation, ISO 26262 
also considers service requirements, up to decommissioning of the vehicle. In this regard, 
developers should take the consequences of aging into account when selecting compo- 
nents. Control units or sensors must be sufficiently protected by robust design in case they 
were fitted with age-sensitive electrolytic capacitors for energy reserves. A failure must 
not suspend any important functions [27]. 


28.4.4.2 Hazard and Operability Study—HAZOP 

A Hazard and Operability Study (HAZOP) is an early risk assessment, developed in the 
process industry. A HAZOP looks for every imaginable deviation from a process in normal 
operation and then analyzes the possible causes and consequences. Typically, a HAZOP 
search is carried out systematically by a specialist team from the involved development 
units. This is to reduce the likelihood of overlooking any important factors [5]. 
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28.4.4.3 Failure Mode and Effects Analysis—FMEA 

Failure Mode and Effects Analysis (FMEA) and the integrated Failure Mode, Effects and 
Criticality Analysis (FMECA) are methods of analyzing reliability that identify failures 
with significant consequences for system performance in the application in question. 
FMEA is based on a defined system, module or component for which fundamental failure 
criteria (primary failure modes) are available. It is a technique for validating safety and 
estimating possible failure states in the specified design-review stage. It can be used from 
the first stage of an automation system design up to the completed vehicle. FMEA can be 
used in the design of all system levels [31, 32]. 


28.4.4.4 Fault Tree Analysis (FTA) 

Fault Tree Analysis (FTA) involves identifying and analyzing conditions and factors that 
promote the occurrence of a defined state of failure that noticeably impacts system per- 
formance, economic efficiency, safety, or other required properties. Fault trees are espe- 
cially suitable for analyzing complex systems encompassing several functionally 
interdependent or independent subsystems with varying performance targets. This par- 
ticularly applies to system designs needing cooperation between several specialized 
technical design groups. Examples of systems where Fault Tree Analysis is extensively 
used include nuclear power stations, aircraft, communication systems, chemical and other 
industrial processes. 

The fault tree itself is an organized graphic representation of the conditions or other 
factors causing or contributing to a defined undesired incident, also known as the top 
event [5]. One possible approach is to demonstrate the probability of road accidents by the 
use of a fault tree which presumes both: inappropriate behavior and the existence of a 
conflicting object [33]. 

Figure 28.4 shows an example for a Fault Tree Analysis. A single failure does not 
necessarily have dangerous impact. This Fault Tree Analysis demonstrates that traffic 
accidents result by the coincidence of several causes. Series of unfortunate circumstances 
and inappropriate behavior of traffic participants can worsen the risk situation to be 
uncontrollable. Human traffic participants are the crucial link in the chain to prevent a car 
crash (see Chap. 17). Especially automated vehicles will require appropriate safety 
measures. Figure 28.4 demonstrates an excerpt of safety measures for a safe active 
steering as used in automated vehicles. 


28.4.4.5 Hardware-in-the-Loop (HIL) Tests 

Increasing vehicle interconnection places particular demands on validating the safety of 
the entire Electronic Control Unit (ECU) network, e.g. onboard wiring systems safety, bus 
communication, vehicle-state management, diagnosis, and flash application’s behavior. 
Hardware-in-the-Loop (HIL) tests can be used as soon as a hardware prototype of the 
system or part of it,—e.g. an electronic control unit in a vehicle—is available. As the 
Device under Test (DUT), the prototype is placed in a “loop,” a software-simulated virtual 
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Fig. 28.4 Fault Tree Analysis (FTA): functional safety measures prevent traffic accidents caused by 
technical active steering failures with the risk of personal injury. Image rights: Author 


environment. This is designed to resemble the real environment as closely as possible. 
The DUT is operated under real-time conditions [34]. 


28.4.4.6 Software-in-the-Loop (SIL) Tests 

The method Software-in-the-Loop (SIL) in contrast to HIL, does not use special hardware. 
The created model of the software is only converted to the code understandable for the 
target hardware. This code is performed on the development computer with the simulated 
model, instead of running as Hardware-in-the-Loop on the target hardware. SIL tests must 
be applied before the HIL. 


28.4.4.7 Virtual Assessment 

Virtual assessment verifies prospective, quantitative traffic safety benefits and risks (see 
Sect. 28.1.2). They can be quantified using virtual simulation-based experimental tech- 
niques. For this purpose traffic scenarios can be modeled taking into account key 
safety-relevant processes and stochastic simulation using large representative virtual 
samples. Virtual representations of traffic scenarios are based on detailed, stochastic 
models of drivers, vehicles, traffic flow, and road environment, along with their interac- 
tions. The models include information from global accident data (see Chap. 17), Field 


606 T. Winkle 


Operation Tests (FOT), Natural Driving Studies (NDS), laboratory tests, driving simulator 
tests, and other sources. Wide ranging, extensive simulations help identifying and eval- 
uating safety relevant situations of automated vehicles. 


28.4.4.8 Driving Simulator Tests 

Driving simulator tests use models of vehicle dynamics and virtual driving scenarios. 
They allow artificial driving situations and repeatable tests with various subjects. Poten- 
tially hazardous traffic scenarios can also be tested because in contrast to real driving the 
virtual scenario is harmless. Different types of simulators, such as mock-up, fixed based 
simulator, or moving base simulator exist. Subjective and objective methods can be used 
to measure the performance of test subjects in the driving task. Depending on the kind of 
potentially hazardous situations, controllability can be tested by some of these methods. 
Typical situations for driving simulator tests are high risk situations, driver take-over 
reactions or interaction between automated driving system environment monitoring and 
manual human driver mode. 


28.4.4.9 Driving Tests and Car Clinics 

Driving tests with different drivers provide useful feedback based on empirical data. 
Dynamic car clinics allow testing of driver behaviour and performance while driving the 
automated vehicle in defined situations within a realistic environment. In a first step the 
objective is to identify relevant scenarios and environments (see Chap. 17). This makes it 
possible to specify and implement virtual tests followed by confirmation via driving tests 
and car clinics on proving grounds. Finally, before sign-off and start of production (SOP), 
field tests confirm identified scenarios and environments if necessary. 


28.4.5 Approval Criteria from Expert Knowledge 


During the approval process, test procedures must be provided. Approval criteria in terms 
of “passed” and “not passed” are thus recommended for the final safety verification of 
automated vehicles. Regardless of which methods were chosen for final sign-off confir- 
mation, the experts should all agree on which test criteria suffice for the vehicle to cope 
successfully with specified situations during a system failure or malfunction. Generally 
accepted values for achieving the desired vehicle reactions should be used for such 
criteria. An evaluation can result by using established methods. 

Taking the list of potentially hazardous situations as a basis (see Sect. 28.4.3), test 
criteria for safe vehicle behavior, and if possible also globally relevant test scenarios, are 
developed by internal and external experts. Of particular importance is a team of system 
engineers and accident researchers. The former group offers knowledge of the precise 
system functions, time factors, and experience of potential failures, while accident 
researchers bring with them practical knowledge of high-risk traffic situations (see 
Chap. 17). Every known risky situation that a vehicle can get into must be considered. At 
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least one corrective action with regard to safety requirements should be specified by the 
developers for the risks identified. In terms of final sign-off confirmation, a test scenario 
has thus been “passed” when the automated vehicle reacts as expected or otherwise deals 
with the situation in a satisfactory accepted manner. 


28.4.6 Steps to Increase Product Safety of Automated Vehicles 
in the General Development Process 


To guarantee the product safety of automated vehicles, a thorough development concept is 
needed that is at least in line with state of the art and science. To this end, a general 
development process is proposed below, as is principally in use amongst car manufac- 
turers for the development of series production vehicles, partially with small adjustments. 
For highly automated vehicles the development refers to measures regarding the safety 
process, activities to ensure controllability and appropriate human machine interaction 
(see Fig. 28.5). 

The generic development process for fully automated vehicle functions even more 
focuses on interdisciplinary networking expert knowledge, the safety process and is repre- 
sented graphically as a V-Model (see Fig. 28.6). As well as the development stages for the 
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high automation it depicts logical sequences of product development phases and selected 
milestones but not necessarily how long each stage lasts or the time between phases [5, 35]. 

The process thus forms a simplified representation in the form of a V-Model. This 
allows for iteration loops within the individual development phases involving all parties. 
Within this V-shaped process structure (see Fig. 28.6) elements of the safety process are 
taken into consideration. In addition, early and regular involvement of interdisciplinary 
expert groups is recommended. From the definition phase until validation, sign-off, and 
start of production—interdisciplinary networking experts from research, (pre-)develop- 
ment, functional safety, product analysis, legal services, traffic safety, technology ethics, 
ergonomics, production, and sales should participate in the development process. 

In the development steps for advanced automated vehicles’ product safety functional 
safety, stands out as a key requirement. It relates to the whole interaction between the 
vehicle and its environment. Safe driver interaction and take-over procedures [1, 36] 
should thus be considered when there is an interface necessary to the use case and 
functionality. Concerning product safety, fully automated vehicles essentially include the 
following five usage situations: Of prime importance is the functional safety of fully 
automated vehicles within, at and also beyond the performance limits. Furthermore, 
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functional safety should be examined during and after system failures. Careful develop- 
ment with regard to a safe usage of driverless vehicles must ensure that they are able to 
recognize the criticality of a situation, decide on suitable measures for averting danger 
(e.g. degradation, driving maneuver) that lead back to a safe state, and then carry out these 
measures. 

Figure 28.7 gives an overview of a possible workflow regarding final sign-off, up to 
decommissioning of a vehicle. In the final stages of developing an automated vehicle, the 
development team decides whether a final safety test for validation is required. This serves 
to confirm that a sufficient level of safety for production has been reached. For this, the 
development team verifies that a vehicle reacts as previously predicted or in other ways 
appropriate to the situation. The data used here may come from risk-assessment methods 
used during development, such as hazard and risk analysis. There are three equally valid 
paths for signing off vehicles. A direct sign-off will be carried out through an 
experience-based recommendation of the development team. In addition, final evidence of 
safety can be passed after corresponding reconfirmation via an interdisciplinary forum of 
internal and external experts or an objective proof. Evidence of functional safety is pos- 
sible via means of a confirmation test with relevant traffic scenarios based on accident-, 


Checklist 
open Items 


Function developers & mannan 
development team of 
automated vehicles 


Consulting: internal experts Objective Evidence 
e Traffic safety of functional safety: 
e Functional safety confirmation test with 
e Ergonomics relevant samples 
e Product analysis Safety & traffic scenarios 
e Legal service confirmation (e.g. virtual-, trial area-, 
e Production field tests) 
e Sales/Marketing 


Consulting: external experts 


e Traffic authority 
e Competitors 

e Suppliers 

e Psychologists 


`| * Lawyers 
Ge: Ethicists ... d 


Sign off 


documentation accidents 


traffic-flow-, weather- 
& vehicle operation 


Monitoring of operati 
service until decommissioning 


Legend: 


Process gates in Expert groups during Methods during Return of feedbac! 
development process approval approval from live cycle 


Fig. 28.7 Recommended sign-off process for automated vehicles. Image rights: Author 


610 T. Winkle 


traffic-flow-, weather- and vehicle operation data (see Chap. 17), or other verifiable 
samples (see Fig. 28.7). 

The development team chooses an appropriate path for each individual scenario. 
A mixed approach is also possible. When the safety team has conclusively confirmed the 
safety of the system design functionality, the final sign-off can be given (see [5]). 


28.4.7 Product Monitoring After Market Launch 


Subsequent to the careful development, a manufacturer is obliged to monitor automated 
vehicles after placing them on the market, in order to recognize previously unknown hazards 
and take necessary additional safety measures. If necessary, car manufacturers are urged to 
analyze potential dangers (that can also arise in unintended use or misuse) and react with 
appropriate measures, such as product recalls, redesign, or user information (see Fig. 28.7). 
A judgment of the German Federal Court of Justice (BGH) is often quoted amongst 
product safety experts as a particular example of the product-monitoring duty for com- 
bination risks with third-party accessories. Model-specific motorbike handlebar cladding, 
from accessories that had first been passed by officially recognized experts from a testing 
organization in June 1977, were supposed to have been responsible for three spectacular 
accidents including one fatality. On the day before the fatal accident, the motorcycle 
manufacturer in question wrote personal letters to warn all the riders of the affected model 
it had on record. The victim, however, never received the letter. Although the motorbike 
manufacturer expressly warned of using the cladding, the company was ordered to pay 
damages. The BGH’s judgment in the matter established a pioneering principle: 


In future, companies will not only be required to monitor the reliability of their products in 
practice but, above all, to refer their customers to any hazards in daily operation — including 
those that arise from the application or installation of accessories of other manufacturers. [37] 


28.4.8 Steps for Internationally Agreed Best Practices 


Due to their networking and complexity, it will be difficult to get a clear overview about 
all the risks of automated vehicles in series operation. Therefore the objective is estab- 
lishing worldwide agreed best practices for legislation, liability, standards, risk assess- 
ment, ethics and tests. 

The ADAS Code of Practice as a result of the Response 3 project was a fundamental 
step towards European agreed and legally binding guidelines for Advanced Driver 
Assistance Systems (ADAS). ADAS were characterized by all of the following properties: 
They support the driver in the primary driving task, provide active support for lateral and/or 
longitudinal control with or without warning, detect and evaluate the vehicle environment, 
use complex signal processing and interact direct between the driver and the system [5]. 
Primarily ADAS operate rule based at the maneuvering level (between about one and ten 
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seconds) and furthermore within parts of the skill based stabilization level (time spans less 
than one second). High and fully automated vehicles will intervene in a knowledge-, skill- 
and rule based manner for more than one second at all driving levels (see Fig. 28.8). 

In general increasing sensitivity for defects is visible through a significant growth in 
product recalls worldwide. If unknown failures appear after vehicles have gone into 
production, appropriate measures have to be taken where necessary according to a risk 
assessment. 

For analyzing and evaluating risks stemming from product defects after market launch— 
in view of the necessity and urgency of product recalls—the EU and the German Federal 
Motor Transport Authority (Kraftfahrtbundesamt) uses tables from the rapid alert system 
RAPEX (Rapid Exchange of Information System) [38]. To classify risks, first accident 
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Fig. 28.9 Risk assessment and derivation of essential measures in accordance with RAPEX, 
ALARP and ISO 26262. Sources RAPEX, ADAS Code of Practice, ISO 26262, ALARP. Image 
rights: Author 


severity (extend of damage S according to AIS, for example) and probability of harm are 
assessed—similarly to the ALARP principle (As Low As Reasonably Possible) [39], the ISO 
26262 standard [27], and ADAS Code of Practice for active longitudinal and lateral support. 
The degree of risk is derived from this. Final assessment concerning the urgency of required 
measures looks at the risk of injury for those at particular risk of being injured (as influenced 
by age, state of health, etc.) and hazard for a mentally healthy adult, and the use of protective 
measures as appropriate warnings (see Fig. 28.9). 


28.5 Conclusion and Outlook 


On the one hand, society’s expectations are understandable as they increasingly require 
the highest, state-of-the-art levels of safety for new technologies. On the other hand, 
unrealistic demands for technical perfection and the striving for 100 % fault-free operation 
may hinder automated vehicles being launched on the market, and thus the chance of 
revolutionary potential benefits. 

Many groundbreaking technologies would not be available to us today had caution and 
reservation gained the upper hand during their introduction. One example of courageous 
innovation is provided by the German engineer and car pioneer Carl Friedrich Benz. As 
early as 1885, he completed the first test drives with his prototype, the properly func- 
tioning Benz Patent-Motorwagen. In his book Lebensfahrt eines Erfinders, Benz 
remembers about his first trip: 


Until that point, it had been at great preference to undertake my test drives far away from the 
city — on factory grounds or outside on the old, lonely ramparts (ring road), which at that time 
still went around the city of Mannheim and was hardly walked on -, I no longer shied away 
from people and their criticism from spring 1886 on. [40] 
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As the motorcar lay motionless with a breakdown, however, Benz attracted pity, scorn, 
and derision: 


How can one sit in such an unreliable, squalid, ear-splitting mechanical box. (...) If I had such 
a stinking box, I would stay home. [40] 


Despite all the denial and rejection with which his unceasing work through countless 
nights for his mission of life was received, Benz, with the support of his wife, held firm to 
his belief in the future of his Patent-Wagen. Thus he became a trailblazer for one of the 
most significant innovations of modern mobility. 

The preparation of vehicles with advanced degrees of automation likewise requires a 
determined approach in the mold of Benz. The market launch of highly and fully auto- 
mated vehicles has also had barriers placed in its path. The first vendors on the market— 
the pioneers—therefore take on increased risks at the outset, so that the potential total 
benefit of these new technologies to society can only be achieved together with all 
interdisciplinary networking parties. Homann describes these decision conflicts during 
market launch by the decision-theory concept of the so-called “Prisoner’s Dilemma”. To 
overcome this dilemma as it pertains to highly and fully automated vehicles, the incal- 
culable risks for manufacturers must be made assessable and determinable through new 
institutional arrangements [41]. Unconditional information and transparent policy 
encourage and accelerate public discourse across all disciplines. 

Due to previous licensing requirements for series production vehicles, drivers almost 
always have to keep their hands on the steering wheel and permanently stay in control of 
the vehicle. Automated research vehicles and vehicle development from IT companies, car 
manufacturers, and component suppliers will also be required to have a human driver as a 
responsible backup level in complex traffic situations for the nearby future. 

Driverless vehicles, on the other hand, signify the beginning of an utterly new 
dimension. New approaches and activities are essential [42]. It is required to orientate 
ourselves to the future potential of automated driving functions, to learn from previous 
patterns and within the bounds of what is technically and economically reasonable and 
adjust old methods to validly state of the art or state of science [43]. 

Besides generally clarifying who is responsible for accident and product risks, new 
accompanying measures depending on different automation and development levels (see 
Fig. 28.6) will also be of use for a successful market launch and safe operation. This 
includes identifying relevant scenarios, environments, system configurations and driver 
characteristics. Relevant maneuvers of driving robots have to be defined and assessed for 
example using accident data (see Chap. 17) and virtual methods. Further investigation of 
real driving situations in comparison with system specifications and additional tests on 
proving grounds, car clinics, field tests, human driver training or special vehicle studies are 
recommended. For the required exchange of information, storage of vehicle data (e.g. Event 
Data Recorder) and possible criminal attacks protective technical measures are necessary 
(see Chaps. 25, 30). Beside challenging and agreed data protection guidelines [44], experts 
in technology ethics will ensure compliance with ethical values (see Figs. 28.3, 28.6, 28.7). 
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Within this, safety requirements have to be answered in terms of “How safe is safe enough?” 
Expert experience can also decisively contribute in increasing safety and meeting customer 
expectations for acceptable risks. In light of increasing consumer demands, such experience 
—-particularly of previous product liability actions—makes a valuable contribution to 
improving product safety during development and approval stages. 

Before highly complex automated vehicle technologies—which will additionally be 
applied in a multi-layered overall system—can go into mass commercialization, inter- 
disciplinary concerted development and sign-off processes are required. A reliable eval- 
uation for sustainable solutions ready for production demands new harmonized methods 
for comparable safety verification, e.g. by simulating relevant scenarios [45, 46] including 
the planning of field tests [47] from worldwide available and combined accident-, 
traffic-flow-, weather- and vehicle operation data (see Chap. 17). This also applies to 
fulfilling legal and licensing regulations, identifying new options for risk distribution (see 
[42]), and creating new compensation schemes. To verify the duty of care in existing 
quality management systems, it is recommended to further develop experience-based, 
internationally valid guidelines with checklists built on the previous ADAS Code of 
Practice [5, 48]. These standards will further embody and document state of the art and 
science within the bounds of technical suitability and economic feasibility. The former 
ADAS Code of Practice was developed to provide safe Advanced Driver Assistance 
Systems, with active support of the main driving task (lateral and/or longitudinal control, 
including automated emergency brake interventions—AEB), on the market and published 
2009 by the European Automobile Manufacturers Association (ACEA). It corresponds 
with the ISO 26262 for requirements of electrical, electronic and software components. As 
a development guideline it contains recommendations for analysis and assessment of 
ADAS-Human-Machine-Interactions with occurrence during normal use and in case of 
failure [5, 6]. With increasing level of automation, upgrades of functional safety, con- 
trollability (ISO 26262, ADAS Code of Practice) and other standardized methods will be 
necessary such as virtual simulation [45, 46]. Today the standards do not cover functional 
disabilities for instance misinterpretation of objects, traffic situations and resulting false 
positive system interventions. An integral, scenario based approach is recommended 
because automated systems will be able to control scenarios. In the event of serious 
malfunctions that threaten severe damage, product experts from the development process 
should be involved in the study of the causes and be listened to. With regard to future 
court decisions, motor vehicle experts who are not directly involved in the development 
should acquire the expertise to be prepared for a specialist appraisal of new technologies. 

In the development of automated driving, networked thinking covering all disciplines 
is required with a flexible, yet structured area for action. So far, the development has 
opened up an unknown world with many uncertainties that may cause reservation and 
resistance. For a successful launch of automated vehicles ready for production, insights 
collected in vivo from both the past as well as the present are essential prerequisites. 
Despite the technical, legal, and economic risks, production readiness will be of benefit to 
society in this way. 
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Part VI 
Acceptance 


Barbara Lenz and Eva Fraedrich 


Foreword 


Autonomous driving not only poses a challenge in terms of further technological devel- 
opment, but also for how the new technical possibilities are received. While media reports 
on autonomous driving have increased markedly in recent times, public debate on the 
resultant expectations—and fears—is still in its infancy. This chapter examines the 
questions and issues preoccupying people in connection with autonomous driving, and 
also the experience of introducing new technologies in the past—experience which must 
be borne in mind when bringing in autonomous driving. That this book closes with these 
questions is not by chance. Technologies are always embedded in a framework that 
determines how people use them, what significance they ascribe to them, and also what 
social functions they fulfill. This is also the underlying motivation for beginning this book 
with the topic of Human and Machine and ending it with that of Acceptance. 

Societal and Individual Acceptance of Autonomous Driving is the subject of Eva 
Fraedrich and Barbara Lenz’s article. The authors outline and discuss the multifaceted 
nature of acceptance, and attempt to furnish this frequently inflationary and sometimes 
imprecisely used term with better-founded understanding. What does it actually mean 
when people “accept” a new technology? Based on the analysis of reader comments in 
German and American media, they demonstrate what topics are currently driving dis- 
cussion. This leads them to some striking findings. 

Is the introduction of autonomous driving really comparable with introducing any 
major technology? And how do we then deal with the risks that stem, or appear to stem, 
from it? In his paper Societal Risk Constellations for Autonomous Driving. Analysis, 
Historical Context and Assessment, Armin Grunwald examines what risks combine in 
autonomous driving and what can be learned from previous experience in risk debates on 
technological progress when developing and using autonomous driving. Grunwald 
develops a series of recommendations relevant to autonomous driving’s implementation, 
and at the same time stresses the necessity of an open and transparent exchange with the 
new technology’s potential users and road users as a whole. 
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Autonomous driving should not be viewed as a wholly new technology appearing out 
of the blue, as it were. Rather, it always builds on what is already there, for example the 
current everyday practice of using (individual) vehicles. In light of this, Eva Fraedrich and 
Barbara Lenz tackle the topic of Taking a Drive, Hitching a Ride: Autonomous Driving 
and Car Usage. Based on an empirical examination of the needs, perceptions, and 
experiences of car users, they map out the complexity of attitudes towards automating 
driving. In particular, they place the reservations held on autonomous driving in context. 
They also demonstrate that the way autonomous driving is currently assessed depends 
fundamentally on two things: first, the social group addressed; second, the specific use 
case or scenario in question. 

The acceptance or non-acceptance of autonomous driving will sooner or later manifest 
itself in the (private or commercial) purchase or non-purchase of an autonomous vehicle. 
How does this impact the significance of automobile brands, given the fact that the “new” 
car must be able to do more than simply drive? In his article What Drives Consumers’ 
Purchase Intentions of Automated Driving Technologies? An Examination of Use Cases 
and Branding Strategies, David Woisetschlager examines the question of what—from the 
perspective of today’s car users—the relevant acceptance criteria might be in future: the 
experience of the auto manufacturers or that of software producers. He shows that there 
currently is still little readiness to purchase autonomous vehicles, and that this is largely 
irrespective of which sector the vehicle has been developed in—it is more important that 
the brand which markets the vehicle is a highly trusted one. With his article on individual 
consumer acceptance, Woisetschläger concludes this last section of the book, which spans 
all aspects of acceptance from the general to the individual. 


Societal and Individual Acceptance 29 
of Autonomous Driving 


Eva Fraedrich and Barbara Lenz 


A good science fiction story should be able to predict not the 
automobile but the traffic jam Frederik Pohl (/1]: 287). 


29.1 Introduction 


What attitudes and expectations do (potential) future users, and the public at large, bring 
to the new technology of autonomous driving? Alongside the technical and legal areas of 
research, this question is moving into ever-greater focus. The emerging debates assume 
that a switch from conventional to autonomous driving might bring about clear changes 
for all road users. From these perspectives—individual users and society—the question of 
acceptance arises. To what extent are individuals ready to use fully-automated vehicles, 
and to what extent are we as a society prepared to accept a transport system with fully 
automated vehicles on the road? 

Public interest in autonomous driving has grown appreciably of late—in surveys, a 
majority now speak of already having “heard of” autonomous driving (see [2]). In mass 
media news coverage, driving’s automation is often portrayed as the solution to many of 
our automobile-related transport problems. It is further expected that it will bring about a 
revolution in car usage and ownership. The term “autonomous driving,” however, is even 
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less clearly defined in the public discourse: sometimes the talk is of automated driving and 
self-driving or driverless cars, sometimes partly- or fully-automated driving. Frequently, it 
is not clear which of the potential transport options is being discussed, what concrete 
options, potential, and risks are involved, or what challenges still need to be overcome on 
the path to autonomous driving. 

The perspectives of road users and potential future users are paid little attention in this, 
even if it is constantly stressed that a user- and usage-oriented view can make an essential 
contribution to acceptance, and thus also to autonomous vehicles’ success (see [3, 4]). 
Acceptance must be brought into the discourse surrounding autonomous driving at an 
early stage, even if the realization of road traffic with fully automated vehicles is not 
currently conceivable at all. Introducing the technology will potentially bring changes 
across the entire sphere of mobility, impacting many levels of society. At the same time, it 
could trigger a fundamental transformation in the way we get around. In order to know in 
good time what the essential issues are, and to control the transformation where necessary, 
it is important to identify the significant influencing factors and understand their 
dynamics. One of these factors is the acceptance of technology. 

This paper begins with a determination of what is to be understood by (technological) 
acceptance, and then discusses which main research areas are relevant in connection with 
autonomous driving. The empirical section begins with the results of current studies on 
autonomous driving’s acceptance. It then introduces the outcome of our own investigation 
looking into the views of today’s road users. This provides findings for future, more 
closely use-oriented empirical analysis on the acceptance of autonomous driving. 


29.2 Acceptance 


When acceptance is talked of, what is meant in general terms is “agreeing, accepting, 
approving, acknowledging; to agree with someone or something” ([5]: 136, translation by 
the authors). This formulation encompasses a sense of “willingness for something,” which 
bestows an active component on acceptance. This differentiates it from simple acquies- 
cence and the absence of resistance, but also from tolerance. Acceptance takes place in the 
context of social and technological construction processes—that is, it is dependent on 
people, their attitudes, expectations, actions, environment, value- and norm-framing etc., 
but also on changes over time (see [6]). The processual and changeable character of 
acceptance makes it overall an “unstable construct” ([7]: 25, translation by the authors)— 
one that depends on various specificities, types, and the subject, object and context of 
acceptance. Moreover, it can vary greatly in the course of time [8]. 

For the acceptance of a specific technology such as autonomous driving, this means that 
various usage options and fears of risk are woven together alongside the technical options, 
on both individual and societal levels. In this way, a technology can alter its “original 
purpose” over time before finally stabilizing, or even becoming institutionalized. The field 
of transport is especially ripe with such examples, starting with the railway originally being 
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invented exclusively for goods transportation, right up to using cable cars as public 
transportation in densely populated inner cities. This progression from the genesis of a 
technology to its adoption poses great challenges for research into acceptance. At each 
stage of technology development, implementation and adoption, different stakeholders and 
stakeholder groups are variously relevant to acceptance. When viewing acceptance in the 
context of such a sociotechnical process of transformation (see [9]), the several stages of 
the process must be distinguished between, as their relevance to acceptance always differs. 


29.2.1 (Technology) Acceptance: Concepts, Research 
and Characteristics 


The subject of technology acceptance is a decidedly inhomogeneous field; various sci- 
entific disciplines (e.g. psychology, sociology, economics, etc.) are related to and have 
mutual bonds with it. Overall, acceptance research is still a relatively young field. The 
topic first came to prominence in the 1970s with broad public opposition to nuclear 
energy. This was postulated—rather unjustly, as things have turned out—to indicate 
general hostility to technology among Germans (for more on this, see Chap. 30, on risk 
analysis and assessment) ([10, 11]: 45 ff). 

The aims of acceptance research are, firstly, a better understanding of particular 
acceptance phenomena (social-science/empirical analysis). Secondly, it is to enable 
specific objects of acceptance, e.g. a specified technology, to be developed and designed 
in such a way that acceptance occurs (normative-ethical approaches). At research and 
policy levels in Germany, several institutions accompany the development of 
(new) technologies and debate surrounding them. They have emerged in parallel with the 
various research approaches to meet these requirements ([11]: 47 ff). All institutions share 
the basic assumption that technology cannot be viewed removed from its embedding in 
social, economic, and also usage-related contexts. In short, technology’s embedment in its 
sociotechnical system must also be taken into consideration (see e.g. [11, 12]). 


29.2.1.1 Acceptance Subject, Object and Context 

Acceptance always takes place within an interplay of subject, object and context (see [13]: 
88 ff): “To be stated is not only what is accepted (or refused), but rather what, by whom, 
within which society, in what situation, at what time, and for what reason” ([13]: 90, 
translation by the authors). Figure 29.1 shows the relationship between the subject, object, 
and context of acceptance. 


Acceptance subject 

An acceptance subject has attitudes, or develops attitudes, in relation to the object of 
acceptance, and also links them, where appropriate, with corresponding actions (see [12, 
13]). The term “subject” refers here not only to individuals, however, but also groups, 
institutions or society as a whole. 
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Fig. 29.1 Acceptance as Subject L | Object 
relational between subject, : : 


object, and context (based on 
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The acceptance subject of autonomous driving can currently be approximated, for 
example, by taking transport system users who will either passively or actively come up 
against autonomous driving in future. This covers all of those using the current road 
system, be it as car drivers, cyclists or pedestrians. Further relevant acceptance subjects 
include developers and engineers, politicians and businesspeople, or even public research 
institutes. 


Acceptance object 

Acceptance object does not necessarily imply a physical object as such, but rather refers to 
the adoption of something “on offer, available, or proposed” ([13]: 89, translation by the 
authors). This may be engineering or technology, but it could also be artifacts of any type, 
or people, attitudes, opinions, arguments, actions, or even the values and norms behind 
such things. In turn, such an object acquires its significance only from what individuals or 
society ascribe to it—there is therefore no such thing as autonomous driving per se. 
Rather, the question is what specific functions autonomous driving can fulfill, and what 
significance individual people and society at large place in the technology. Behind this is 
the assumption that engineering and technology have no significance in and of them- 
selves; instead, this is only attained by the fulfilling of social functions, human actions, 
and their embedding into social structures (see [9]). 


Acceptance context 
The acceptance context refers to the environment in which an acceptance subject relates to 
an acceptance object—and thus can only be viewed in relation to both. For example, the 
context of autonomous driving is determined by the current individual and social sig- 
nificance of car usage: Why do people use cars? What attitudes, values, expectations, etc. 
inform (auto)mobile praxis? Does autonomous driving fit in here seamlessly—or will it 
change the meaning of (auto)mobility and its system of norms? 

In the copious literature on acceptance and acceptance research, various dimensions 
and levels are identified where acceptance is visible and, above all, comprehensible. In the 
following, we shall take a closer look at the dimensions of attitudes, actions, and values. 
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29.2.1.2 Dimensions of Acceptance 


Attitudes dimension 
Attitudes regarding acceptance that can be surveyed include mindsets, values, and 
judgments. These can be polled and interpreted on both individual and societal levels. 
Attitudes are significant for acceptance research, as it is assumed that they can be read as 
willingness and intent for concrete actions ([13]: 82 f). Nevertheless, questions on the 
genesis of technology, its specific usage, the associated challenges, and frameworks—all 
in their specific contexts—cannot be captured with such measuring of attitudes ([11]: 46). 
A typical measuring instrument of the attitudes dimension of acceptance is the opinion 
poll—even though such surveys quickly lead “to a simplified picture of an opinion- 
forming process based on the perceived properties of technology” ([14]: 35, translation by 
the authors). This is because they imply that technology sends out signals that spark off set 
reactions in the population or individuals. One-dimensional surveying of attitudes has 
been replaced in recent years, however, with greater insights into technology acceptance, 
and expanded into an analysis that incorporates attitudes’ contexts in particular. In this 
way, the focus of acceptance research shifted from the “descriptive inventory of attitudes 
and actions” ([14]: 36, translation by the authors) to a more analytically aligned per- 
spective. This takes greater account of the complexity in individuals’ perceptions and 
evaluations, experts’ subjectivity, and the significance of contextuality ([14)). 


Actions dimension 

The actions dimension of acceptance describes observable behavior, although acting in 
this sense may relate either to doing something or to refraining from it. Actions can 
manifest themselves in many ways, for instance in purchasing, using, and spreading (or 
the opposite, e.g. initiating protests), or in supporting other (decision-making and plan- 
ning) activities. 

The dimension of actions is often equated with that of acceptance, as found in Lucke, 
for example (see [13]: 82). On the other hand, other authors do not view action, or a 
concrete intention to act, as imperative for acceptance ([15]: 19, [16]: 11). Schweizer-Ries 
et al. ([16]: 11) have depicted this reciprocity between the dimensions of actions and 
attitudes in a two-dimensional model (Fig. 29.2). 


Values dimension 

In many approaches, the values dimension is not viewed as a separate level of acceptance, 
but combined with the attitudes dimension. Values and norms, according to this argument, 
are also the basis of attitudes and therefore can only be separated from them with diffi- 
culty. The dimension of values comes into its own, however, when acceptance is visible 
on the level of actions, for instance in the use of a specific product. These actions may 
only accord with subjective individual values slightly or not at all—a person can own and 
use a car while being strongly ecologically-minded. This, in turn, may show itself more 
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clearly in other areas of activity—for example, by mainly or only shopping in organic 
grocery stores. In the context of autonomous driving, ethical criteria and social standards, 
which (must) determine how it is viewed, are especially challenging—see Chaps. 4 and 5 
in this volume. In general, an acceptance object is also always evaluated in relation to an 
existing system of norms and values (see [14]). 


29.2.1.3 Research on Acceptance 

Acceptance takes place not only on various levels as described above, but is also the result 
of a complex individual and collective process of evaluation and negotiation, sometimes 
even of relatively unspecific “sensitivities” ([8]: 55, translation by the authors). This raises 
the question of how such a process can be made measurable and thus empirically 
accessible. For a relatively new technology such as autonomous driving, this means to 
examine in what way individual stakeholders (e.g. users), social groups, organizations, 
and institutions meet the challenges of technological and scientific progress as well as “to 
identify the potential for design to meet social challenges and to test technological options 
in view of their problem-solving capacity” ([12]: C, translation by the authors). 

In summary, we may say that, for acceptance research, acceptance “is a complex, 
multilayered construct that is not directly measurable, and for which there are no “cal- 
ibrated” measuring instruments” ([12]: 21, translation by the authors). Depending on the 
acceptance object in question, but also on the relevant dimensions, only indicators specific 
to each case may be operationalized and rendered measurable— which in turn excludes the 
use of others. This should also be reflected in the research process. 


29.3 Acceptance of Autonomous Driving: The Current State 
and Focus of Research 


Autonomous driving can be placed alongside products of everyday technology. In contrast 
to working technologies and so-called external technologies, such as nuclear power or 
satellite technology, everyday technologies mainly involve products for individual 
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consumers, and are controlled by the market. Nonetheless, they can have consequences 
for third parties ([14]: 31). Car usage and ownership are typical examples from this area. 
Acceptance of technology in this context primarily means purchase, but as a rule also 
includes use. Particularly at the beginning of autonomous driving’s potential implemen- 
tation, however, it may be assumed that not only the level of private or individual 
consumption plays a role, but also that the effects on various social spheres are publicly 
discussed and weighed up. This could include questions of whether we can permit 
vehicles in our transport system that will probably be involved in accidents just like 
conventional vehicles—but with the possible difference that the machine or driving robot 
causes the accident, not only endangering its own occupants but all road users. Recently 
there has also been the question of the common good (for more on this, see Chap. 30 on 
risk analysis and assessment Chap. 4 on the ethics of autonomous driving). 

It is possible that autonomous driving may bring with it other social or economic risks 
and consequences that could be the subject of public debate. It will thus also be important, 
in empirical terms, to demarcate the border between these two spheres—the individual and 
the societal aspects of acceptance—as clearly as possible, and to establish “how techno- 
logical attributions come about as internally or externally controlled” ([14]: 32, translation 
by the authors). In general, no hostility to technology is visible in Germany, and in the 
sphere of its individual use, the reverse is even true. To a great degree, many German 
households have, and constantly use, everyday technological products (see [10, 17]). 

In summary, it is often said of autonomous driving that such vehicles will only be 
accepted if, on the one hand, they drive “better” than humans, and on the other, if the 
vehicle user can override the autonomous functions as a last line of control (see [4]: 2 ff). 
However, Grunwald reports elsewhere in this volume that risk perception is many times 
more complex than such statements would have us believe (see Chap. 30). 

Analogies to other technologies from these areas, and thus their experience of 
acceptance, tend to be difficult to make. Although we already have many examples of 
automated transport systems today (for instance airplanes, ships, (metro) trains, and 
military vehicles), they all still have humans with authority to supervise or control them. 
We do not yet have a vehicle or mobility system without this human authority ([4]: 6). For 
this reason, autonomous driving could place unique demands on acceptance. 

The question of which factors, characteristics, demands, expectations, value systems, 
of whom and to whom, and what, etc. is connected with autonomous driving’s acceptance 
—all this has not yet been sufficiently empirically recorded. Some studies dealing with the 
topic from market and opinion research have found a general and also increasing openness 
to autonomous driving (see [2, 18, 19]). But these do not make clear what the respondents 
actually understand as “autonomous driving,” in which context their perceptions and 
evaluations are embedded, and what challenges and obstacles, and also benefits, may be 
identified in relation to it. 

On the user side, surveys directly testing judgments of autonomous driving are cur- 
rently also subject to the problem that, to date, neither broad levels of knowledge, nor 
concrete experience may be assumed. Attitudes and assessments recorded as such are 
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therefore possibly of only limited validity, for the object of the survey is not yet clearly 
defined, as people have hardly encountered it. In their study on acceptance and electric 
mobility, Peters and Diitschke suggest the following: “Surveys of potential users, for 
instance questionnaires as to whether or under which circumstances they would be 
prepared to buy an electric car, have the problem that judgments on the new, still little- 
known system of electric mobility are difficult for consumers to make. As a rule, they rest 
on a comparison to conventional vehicles on the basis of previous mobility patterns” 
([20]: 6, translation by the authors). A comparable assessment can be carried over to 
autonomous driving. 

The few studies that have considered aspects of autonomous driving’s acceptance give, 
in part, quite a heterogenous picture. In their study of active and passive safety systems, 
Frost and Sullivan show that the majority of car users to date resist the idea of giving up 
control of their vehicle to a machine or robot [21]. Other surveys, on the other hand, have 
demonstrated that young drivers between 19 and 31 in particular often find driving to be 
burdensome—specifically, driving can stop them addressing other, more important, 
meaningful or interesting activities: “Regulation keeps trying to say texting is distracting to 
driving but for the consumer it is really the driving that is distracting to texting” ([22]: 2). 
A poll of Europeans’ desires for the car of the future also revealed that some two thirds 
of respondents are open-minded concerning autonomous driving [18]. Although an 
international survey of car drivers in Germany, China, the USA, and Japan found 
openness in principle, it also showed that a large number of those questioned in all 
countries currently (still) harbor doubts about the technology’s safe operation [19] or are 
even rather scared of it [2]. 


29.4 The Road-User Perspective 


Despite the haziness in the empirical methods outlined above, the main questions when 
looking at autonomous driving’s acceptance have to be: How is the acceptance object 
actually perceived? What acceptance-relevant issues, on either individual or social levels, 
are associated with the technology? The aim must be to obtain initial indications as to the 
dimensions of attitudes and values regarding acceptance, and to identify the concrete 
expectations, hopes, desires, even fears, linked with the development, use, and design of 
the technology (see [12]). Within the “Villa Ladenburg” project, the first work on indi- 
vidual and societal acceptance was therefore an exploratory study that took a broad look at 
the point of view of today’s road users—who are also tomorrow’s potential users of 
autonomous driving. In the process, essential issues of perceived use from a subjective 
perspective were considered. The survey also addressed discernible differences in different 
socio-cultural environments—in this case Germany and the USA. These are among the 
leading automobile nations, where wide-ranging debates on autonomous driving have 
already begun with media coverage of the topic having increased noticeably in the last two 
years. This indicates that autonomous driving is gradually gaining the public’s attention. 
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29.4.1 Methods 


The study analyzed statements from comments on autonomous driving. The method- 
ological approach took the form of an analysis of how online articles in widely distributed 
print media were received. This reception can be traced in the online comments by the 
users. In particular, this approach assumes that media discourse has a critical influence on 
individual and societal opinion forming (see [23]). One criterium in selecting articles was 
that the online news portals they were published in should give a representative picture of 
the German and US print media landscapes. This permits the assumption that the articles 
both reflect and help to form the current public discourse on autonomous driving. For 
Germany, the comments analyzed were on articles from Bild [24], Die Welt [25], 
Frankfurter Allgemeine Zeitung [26], Heise online [27], Spiegel Online [28-30], Süd- 
deutsche.de [31] und Zeit Online [32]; for the USA, from the Los Angeles Times [33], NY 
Daily News [34], The New York Times [35], San Francisco Chronicle [36], The Wall 
Street Journal [37] und The Washington Post [38]. In total, 827 comments on 16 articles 
were evaluated. To ensure as great a combarability as possible, most articles concerned 
California’s decision at the end of September 2012 to allow Google’s driverless cars onto 
its roads. In terms of “conceptual representativeness;” a theoretical sampling was 
undertaken ([39]: 154 ff), i.e. in the course of the analysis, comments were analyzed in 
stages, which in the end led to three comparison groups: (1) comments from German mass 
media portals, (2) comments from US mass media portals and (3) comments from one 
technology-centred German portal (Heise online). The evaluation used a qualitative 
content analysis following Mayring [40] whose aim is to identify texts’ meanings, par- 
ticularly those not immediately apparent. This is done using a systematic and intersub- 
jectively verifiable analysis that meets the linguistic material’s interpretational 
requirements and wealth of meaning. The result of the (summary) contents analysis is an 
inductively developed category system ([40]: 67 ff). This reflects how the topic of 
autonomous driving is discussed and negotiated from the online commenters’ point of 
view; which issues and features are perceived; and how these are assessed. To this end, all 
comments were coded—the smallest coding unit within a comment was one word. A total 
of 1,421 codings were made in this way, and in successive steps of reduction and 
abstraction, were condensed into the category system. 


29.4.2 Results 


The category system, consisting of almost 60 categories and subcategories, is divided into 
two levels. First there is an object-related level, which is also the more objective of the 
two. This encompasses statements that contained (positively and negatively) perceived 
features of the technology, as well as connected topics concerning its general and specific 
potential for development, and also those on the legal framework, liability questions, etc. 
Such statements are above all oriented around the object of acceptance, and 
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Fig. 29.3 Two-level category system 


simultaneously closely linked to the acceptance context. On the more emotional level, on 
the other hand, the question at hand is the subject of acceptance—statements mostly 
directly refer to the commenters themselves and contain attitudes, judgments and sub- 
jective motivations regarding autonomous driving. These are also essentially strongly 
linked to the context of acceptance, for example with the context of car usage and 
ownership. Around 15 % of all statements were not applicable to the research object and 
therefore were deemed to have no relevance. Figure 29.3 shows the category system and a 
reduced graphic overview and Table 29.1 has the percentages of statements on the two 
levels as well as the survey’s general figures. 


Table 29.1 Distribution of statements, general figures 


Ger USA Hei Ger USA Hei 
Level Mentionsin % Level Mentionsin % 
Objective/object-related 43 47 48 Affective/subjective 43 32 33 


Ger USA Heise Online 


Political-ideological connotation 0% 8% 0% 
Statements without 14% 13% 19% 
relevance 

Total comments 314 322 191 
Total cases 214 221 82 


Total codings 536 527 358 
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29.4.2.1 Object-Related Level 


Perceived features and consequences of autonomous driving 

Distributed among the three comparison groups (German and US mass media; tech-savvy 
Heise online), between 43 and 47 % of all statements were attributable to the object-related 
level. Table 29.2 shows a selection of the categories and their percentage distribution. The 
comments give concrete expectations in relation to the features of autonomous driving, but 
also to the potential changes and consequences for transport and social systems, and in legal 
terms. At least two thirds of the anticipated features and consequences have clearly positive 
connotations, as many as 70 % in the German-media comments. These may, for example, 
refer to expected safety benefits of autonomous driving, which are expected to greatly 
reduce, if not completely prevent, road traffic accidents in future. One user puts it thus: 


Table 29.2 Statement distribution of N = 647 on an objective/object-related level 


Ger USA Hei Ger USA Hei 
Category Mentions in % Category Mentions in % 
Features, 60 66 27 Liability, insurance and law 21 16 19 
consequences of 
autonomous driving 
Positive Al 67 70 Liability issues 15 34 51 
Safety, reliability 39 39 37 Legislative modifications 19 8 28 
Flexibility, comfort 28 18 30 Cost developments 6 24 18 
Contribution to traffic 11 11 9 Civil law questions 0 34 3 
optimization 
Integrative transport use 8 10 0 Development perspetives 19 18 54 
Progress 5 ly 6 Social and general 11 11 9 
Sustainability 5 3 9 Technology & vehicle 23 29 35 

design 
Cost savings 4 2 9 Human-machine 2 7 25 
interaction 

Negative Ze | She) 30 Transport & geography 25 11 1 
Social consequences 47 63 22 Driving and ownership 39 29 24 
Data misuse 18 11 14 Questions 0 13 0 
Deficiencies in technical 15 11 0 
infrastructure 
Cost increases 10 5 57 


Uncerrtainties 10 10 Y 
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“A car, though, should actually be much safer on the road than with a driver, as it will have 
a lot more sensors to see what’s coming, be able to look in all directions at once, and have a 
reaction time close to zero.” On the negative side, the main fears revolve around the social 
consequences, for instance job losses: “What they are working towards is the abolition of 
the German car industry. Nobody is going to buy a Porsche or a nice fat Benz if they will 
only get schlepped around like every other Tom, Dick or Harry. [...] Losing the German car 
industry means ca. 25 % fewer of the most highly qualified jobs.” Other issues associated 
with autonomous vehicles in the statements included—on the positive side—flexibility and 
comfort, transport optimization and efficiency, integrated transport use (“travel- 
strengthening” currently restricted transport users), general progress accompanying tech- 
nology, and cost savings. On the negative side, a series of issues were mentioned beyond 
fears of social consequences: data misuse; deficiencies in the technical infrastructure, i.e. the 
assumption that such vehicles will not be safe (enough); increased costs; and relatively 
unspecific uncertainties surrounding the way these vehicles will function. Thus several of 
the positively perceived features find their negative counterparts here: safety vs deficiency 
thereof, cost savings vs increased costs, progress vs social consequences. 


Liability, insurance, and law 

According to our evaluation, liability, insurance, and law are topics of particular concern 
in Germany—expected modifications to the legal framework will also be accompanied by 
changes to the insurance set-up. This signals uncertainty for almost half the statements on 
this topic on German mass media portals. One user framed it this way: “This car is not a 
technological problem, but a legal one. Whose fault is it, then, if the car causes an 
accident? The driver’s or Google’s?” A country-specific problem also materialized in the 
US comments, however, albeit often in ironic fashion—the auto insurance and 
liability-centered legal profession, seen as being addicted to disputes and litigation, might 
stand in the way of a successful roll-out of autonomous vehicles: “Leave it to the trial 
lawyers to spoil the party!” was how one commenter summed up this view. Further 
discussion on this topic revolved around the necessary future legal changes and devel- 
opment of costs. 


Development perspectives for autonomous driving 

Particularly on the Heise website, many commenters address development perspectives in 
the context of autonomous driving which go far beyond features exclusively associated 
with technology (54 % of all object-related comments). Such statements may be about 
social development in a rather general sense, but also the future development of car usage 
and ownership, design and vehicle equipment, the interaction between humans and 
machines, and considerations on the future form of transport and urban space. One user, 
for instance, touches on the consequences of a changed legal framework: “The question is 
no longer ‘who is liable when there are car accidents? but rather ‘who will still be 
allowed to drive manually?” 
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29.4.2.2 Subject-Related Level 


Evaluative attitudes and expectations 
As a rule, comments in online forums consist of several statements that can be categorized 
to several levels or (sub)-categories—statements on a more “objective” level are often 
linked with the more subjective/emotional one. When, for example, negative features are 
associated with autonomous driving, commenters likewise tend to take a dismissive stance 
to using the new technology, and vice versa: “J don’t want to let the controls out of my 
hands! Certainly not to a computer that can be manipulated and hacked, just like PCs and 
cellphones!” This statement combines security fears (an autonomous vehicle, similarly to 
a computer, will not be entirely secure, data may be misused) with a subjective refusal. On 
the other hand, the expectation that autonomous vehicles are especially comfortable and 
flexible may accompany positive personal assessments of the technology: “Fully auto- 
mated driving with no annoying passengers, no train cancellations and delays—that’d be 
really great.” Statements are not always linked on the different levels, however. Judg- 
ments can also be made with no further justifications given, such as this one from US 
online portals: “Yes. Easiest question I’ve been asked all day!” or “Jerry, I support you, 
but not on this” (“Jerry” refers here to the Governor of California, Jerry Brown, who 
accorded Google driverless cars their street-legal status to media fanfare in the Google 
headquarters in 2012). 

In general, although the technology is clearly positively perceived (see above—“Per- 
ceived features and consequences”), it is rather ambivalently-to-negatively assessed (more 
than two thirds of all statements in this category do not have positive connotations, see 
Table 29.3). Mistrust and skepticism is either related to the technical development, its 
whole rationale, or whether it will be possible to bring in the technology at all. The 
category of ambivalent statements largely concerns the prerequisites and consequences 
(on the technical, social or infrastructural side) deemed essential before assessing 
autonomous driving positively. 


Car usage and ownership 

The perception of autonomous driving is strongly bound up with subjective and personal 
motives of individual car use. Our analysis was able to identify two opposite poles in the 
assessment of autonomous driving. On one side, there are statements which stressed 
motivations for using cars due to their comfort and flexibility, and their “general” benefits. 
Such statements also generally contain a rather positive appraisal and assessment of 
autonomous driving: “Cars do have, above all, this almost ubiquitous character, because 
it is so practical. I would find it more practical if I could order such an auto-auto to my 
front door online and have it drop me off at any destination without me having to bother 
with parking. If this vision of the future becomes possible, then goodbye Porsche!” On the 


634 E. Fraedrich and B. Lenz 


Table 29.3 Statement distribution for N = 516 on an affective-subjective level 


Ger USA Hei Ger USA Hei 
Codes/Levels Mentions in % Codes/Levels Mentions in % 
Judgments, 86 84 78 Motivation for car use 14 16 22 
attitudes, and ownership 
expectations 
Negative 48 53 3 General 34 27 20 
Mistrust, Skepticism 76 67 91 Related to autonomous 66 73 80 
driving 
Refusal 24 33 9 — Pro auton. driving 48 21 25 
Positive 35 35 30 — Contra auton. driving 43 79 25 
Optimism, trust 55 43 44 — Ownership, 9 0 50 
carsharing 
Imaginable, 35 47 41 
desirable 
Basic interest 10 10 15 
Ambivalent 17 12 33 


other side, there are statements highlighting issues of freedom, control and the fun of car 
driving; most of these are skeptical-to-dismissive of the new technology: “Without driving 
by myself, where’s the fun in that? Technology or no technology: I want to give orders to 
my car myself, not any computer.” Furthermore, some users discuss in very general terms 
which motives and attitudes underlie their car use, or raise the question of why anyone 
would (or would not) actually buy a car in a future with autonomous vehicles. 


29.4.2.3 Comparing the Groups: Germany, USA and Heise Online 

Many perceptions, assessments, perspectives, and value systems showed up in similar 
measure in all three groups. However, there are some clear differences in some areas, 
which were either specific to the country or level of knowledge (for Heise online com- 
ments, it was safe to assume a far higher level of knowledge on autonomous driving, as 
well as understanding of technology and engineering in general). Alongside the 
group-specific topics of development perspectives and liability, insurance and law men- 
tioned above, we also saw that US commenters look at autonomous driving in far more 
socio-political terms in comparison to their German counterparts (see Table 29.1). Fur- 
thermore, evaluating the topic of car use and ownership revealed that fun in driving, 
individual freedom, and control of the vehicle are the predominant motivations for car use 
among US comments. This is mostly accompanied by an attitude of refusal regarding 
autonomous driving (79 % in the USA compared to 43 % of German mass media com- 
ments and only 25 % of the tech-savvy posts). 
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The questions on liability were overall most controversially discussed on Heise online, 
while the few statements on this topic on US sites see liability as lying with manufacturers 
in future. In contrast, a majority of people (58 %) commenting on Spiegel and co.—that 
is, the German mass media—think that liability will also lie with the vehicle owner in 
future. 

The general tone of German comments is overall somewhat more positive. On both the 
Heise website and those of the German mass media, positive features of autonomous 
driving were discussed more often than on US ones (70 and 71 % as opposed to 61 %). At 
the same time, less negative judgments were made (37 and 48 % as against 53 %). 


29.4.2.4 Summary 

In both the US and German reader comments made on the mass media portals, statements 
predominate that are still currently focused on the expected features of autonomous 
driving. That is to say, the acceptance object is in fact the physical object—the car—and 
its individual use. This takes a different form on Heise online, where discussions already 
range far beyond familiarization with purely “technical” issues. Instead, they debate 
concrete user scenarios and see autonomous driving more strongly in the context of the 
overall socio-technological system of (auto)mobility. Most of those posting on the Heise 
portal clearly possess greater knowledge of the technology than “normal” media con- 
sumers. Public debate on autonomous driving has only just begun to pick up speed in the 
last two to three years. We may therefore assume that, as it progresses, topics covering not 
only the technology, but also its embedding in the system, will become of greater 
relevance. 

Overall, our study spans the “scope of acceptance” for autonomous driving as it 
currently stands. This scope results from the topics setting the public agenda via the media 
at present; these topics are also linked to specific judgments. When considering the range 
of topics, it is apparent that some negative features accompany the mostly positive ones 
attributed to autonomous vehicles. Furthermore, a series of questions have been thrown up 
which still need clarifying from commenters’ point of view. Depending on how they are 
answered, this will, in turn, have an impact on acceptance. The ambivalence that finds 
expression here is amplified when objective/object-related statements are supplemented by 
affective/subjective ones. Although autonomous vehicles as such are mainly adjudged 
positively, there are also responses to autonomous driving and the roll-out of autonomous 
vehicles in the transport system that range from distinct mistrust and clear skepticism to 
downright refusal. This attitude is especially often associated with fear of negative social 
consequences, and also loss of freedom. 

Such an ambivalent stance vis-a-vis autonomous driving is, however, typical for atti- 
tudes to technology—and is mirrored in the findings of other technology-acceptance 
studies (in Germany) [14]. On the one hand, many benefits are associated with autono- 
mous driving that may make life more comfortable and open up new possibilities. On the 
other, the expected changes are accompanied by fears of negative social consequences. 
These manifest themselves in “loss of control of one’s own environment and one’s own 
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life” ([14]: 33, translation by the authors). At the bottom of this ambivalent response lies 
the desire “to bring one’s personal environment and technology together in harmony and 
to preserve the social, economic and natural environment for future generations” ([14]: 
33, translation by the authors). As our analysis has shown, the debate on autonomous 
driving not only revolves around making motorized personal transport safer, more com- 
fortable, more flexible, more efficient, etc., but also highlights and reflects on the societal, 
social and economic effects that it will usher in. 


29.5 Outlook 


Acceptance research, we have argued, must go beyond solely researching opinions and 
attitudes. It should rather, in terms of an anticipatory societal market research (cf. [12]: 3), 
identify requirements, ideas, desires, hopes, fears and anxieties, and classify these in the 
context of a socio-technical system—in this case the transport system as part of the overall 
social system—and its development. In this way, potential can be brought in line with 
concrete options (see [41]). A complex topic like autonomous driving touches on various 
aspects of our society, which is why interdisciplinary cooperation—such as the “Villa 
Ladenburg” project of the Daimler and Benz Foundation, which initiated and brought 
together the articles in the present volume—is indispensable. 

Future studies on the acceptance of autonomous driving should place greater focus on 
both cultural-, type-, and milieu-specific differences in acceptance, and interdependencies 
between different aspects of the topic. The assessment of online comments has provided 
important initial insights here, and shows the way for future surveys. The ambivalent 
results concerning motivations for car usage must be given greater consideration. This will 
make it possible to categorize the individual and social significance of the way cars are 
used and owned; the symbolic, emotional, and instrumental features ascribed to autono- 
mous vehicles; and the influence current car use and ownership patterns can be expected 
to have on the autonomous vehicles’ acceptance. Chap. 31 focuses on these questions. 

In public discourse at least, it is currently not at all clear what is actually meant when 
autonomous driving is under discussion—this is true of how the media both perceives and 
presents the technology. Are autonomous (private) vehicles being discussed where the 
driver can take the controls now and then? Or is it about driverless taxis that, “on 
command” as it were, can transport both people and goods anywhere, anytime? It can 
currently be assumed, as our analysis has also demonstrated, that many questions 
accompanying a potential future roll-out of autonomous vehicles in our transport system 
still need answering. This in turn means, however, that there is no clear answer to the 
question of the use of autonomous driving, on both individual and societal levels. At 
present, it can only be imagined which assigned values will assume the most important 
roles in autonomous driving. We have, though, been able to at least give an insight into 
the relevant topics associated with the technology: safety, comfort, cost savings, envi- 
ronmental impacts, time savings, equal opportunities etc. 
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Furthermore, the context of acceptance and autonomous driving described above is of 
central significance for future studies. This conclusion can also be taken from the results, 
among others, of US comments, with their marked socio-politically connoted statements. 
These show that, to the commenters, autonomous driving looks like it may collide with 
the prevailing system of norms and values of car usage. Future studies should therefore 
investigate the individual and societal significance of how cars are used today, and then 
enquire precisely into how this is embedded in the context of daily praxis and cultural- and 
milieu-specific frameworks (on this, see also Chap. 31). This will help to define which 
specific issues can be expected to have an effect on the acceptance of autonomous driving. 

In terms of defining uses and assigning values more precisely, in future it will also be a 
question of allowing potential users and other persons affected to experience the tech- 
nology. This will give them an idea about what to expect from it, but also let them know 
what it cannot do. To this effect, policy and public bodies especially could help in 
promoting acceptance, or at least access ([4]: 3), by shaping public debate more vigor- 
ously or initiating specific autonomous driving test and pilot projects: For the current 
efforts and endeavours being made on the policy side, see Chap. 8. In other areas of the 
project, it is already clear that specific use cases, as outlined in Chap. 2, each bring with 
them specific judgments, expectations, and assessments (see Chap. 31 on car usage and 
ownership in the context of autonomous driving and Chapters by 6, 12 and 32). 
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Societal Risk Constellations 30 


for Autonomous Driving. Analysis, 
Historical Context and Assessment 


Armin Grunwald 


30.1 Introduction and Overview 


Technological advancement is changing societal risk constellations. In many cases the 
result is significantly improved safety and accordingly positive results such as good health, 
longer life expectancies and greater prosperity. However, the novelty of technological 
innovations also frequently brings with it unintended and unforeseen consequences, 
including new risk types. The objective of technology assessment is not only to identify the 
potential of the innovation but also to examine potential risks at the earliest possible stage 
and thus contribute to a reasoned evaluation and sound decision-making [10]. 

In many respects, autonomous driving represents an attractive innovation for the future 
of mobility. Greater safety and convenience, use of the time otherwise required for driving 
for other purposes and efficiency gains on the system level are a few of the most com- 
monly expected advantages [5]. At the same time, the systems and technologies for 
autonomous driving—like any technology—are susceptible to errors that can lead to 
accidents resulting in property damage or personal injuries. The central role of software 
can lead to systemic risks, as is well known from the internet and computer worlds. 
Economic risks—for example for the automotive industry—must also be considered, as 
well as social risks, such as privacy concerns. Early, comprehensive analysis and eval- 
uation of the possible risks of autonomous driving are an indispensable part of a 
responsible research and innovation process and thus equally important preconditions for 
acceptance both on the individual and societal levels. Against this backdrop, this chapter 
will provide answers to the following questions as they apply specifically to technology 
assessment: 
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— What specific societal risk constellations are posed by autonomous driving? Who 
could be affected by which damages/injuries and with what probability? 

— What can be learned from previous experience with risk debates on technological 
advancement for the development and use of autonomous driving? 

— How can the societal risk for the manufacture and operation of autonomous vehicles be 
intelligibly assessed and organized in a responsible way? 


The answers to these questions are intended to draw attention to potentially prob- 
lematic developments in order to take any such issues into account in design decisions and 
regulations and thus contribute to responsible and transparent organization of the societal 
risk. 


30.2 Risk Analysis and Ethics 


We define risks as possible harm that can occur as the result of human action and 
decisions. Many times we are willing to accept some risk, for example because we regard 
the damage as very unlikely to occur or because we expect a benefit from the decision that 
outweighs the possible damage that could occur. In some cases, however, we are sub- 
jected to risks by the decisions of others, for example through the driving behavior of 
other drivers or political or regulatory decisions concerning business policy. 


30.2.1 Risk-Terminology Dimensions 


Risks contain three central semantic elements: the moment of uncertainty, because the 
occurrence of possible damage is not certain; the moment of the undesired, because 
damage is never welcome; and the social moment, because both opportunities and risks 
are always distributed and are always opportunities and risks for particular individuals or 
groups. 

The moment of uncertainty gets to the epistemological aspect of risk: What do we 
know about possible harms resulting from our actions and how reliable is this knowledge? 
This question comprises two subquestions: (1) What type and how severe is the harm that 
could occur as a result of the action and decision and (2) how plausible and probable is it 
that the harm will actually occur? For both questions, the spectrum of possible answers 
ranges from scientifically attested and statistically evaluable to mere assumptions and 
speculations. If the provability of occurrence and expected scale of the damage can be 
specified quantitatively, their product is frequently described as an ‘objective risk’ and 
used in the insurance industry, for example. Otherwise one speaks of ‘subjectively’ 
estimated risks, for example based on the perception of risk among certain groups of 
people. Between these poles there is a broad spectrum with many shades of gray with 
regard to plausibility considerations. 
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The moment of the undesired is, at least in the societal realm, semantically inseparable 
from the concept of risk: As representing possible harm, risks are undesirable in them- 
selves.' Nevertheless, the evaluation of the possible consequences of actions as a risk or 
opportunity may be disputed [2]. One example is whether genetic modification of plants is 
perceived as a means of securing world nutrition or as a risk for humanity and the 
environment. The assessment depends on the expected or assumed degree of affectedness 
by the consequences, which in combination with the uncertainty of those consequences 
leaves some room for interpretation—and thus all but invites controversy. 

Finally, risks also have a social dimension: They are always a risk for someone. Many 
times, opportunities and risks are distributed differently among different groups of people. 
In extreme cases, the beneficiaries are not affected by possible harms at all, while those 
who bear the risks have no part in the expected benefits. So in deliberations regarding 
opportunities and risks, it is not sufficient to simply apply some abstract method such as a 
cost-benefit analysis on the macroeconomic level; rather, it is crucial also to consider who 
is affected by the opportunities and risks in which ways and whether the distribution is fair 
(Chap. 27). 

We accept risks as the unintended consequences of actions and decisions or we impose 
them on others [15], or expose objects to them (such as the natural elements). When we 
speak of a societal risk constellation, we are referring to the relationship between groups 
of people such as decision-makers, regulators, stakeholders, affected parties, advisors, 
politicians and beneficiaries in view of the frequently controversial diagnoses of expected 
benefits and feared risks. Describing the societal risk constellations for autonomous 
driving is the primary objective of this chapter. It is crucial to distinguish between active 
and passive confrontation with the risks of autonomous driving: 


1. Active: People assume risks in their actions; they accept them individually or collec- 
tively, consciously or unconsciously. Those who decide and act frequently risk 
something for themselves. A car company that views autonomous driving as a future 
field of business and invests massively in it risks losing its investment. The harm 
would primarily be borne by the company itself (shareholders, employees). 

2. Passive: People are subjected to risks by the decisions of other people. Those affected 
are different than those who make the decisions. A risky driver risks not only his or her 
own health but also the lives and health of others. 


Between these extremes, the following risk levels can be distinguished analytically: 
(1) Risks that the individual can decide to take or not, such as riding a motorcycle, 
extreme sports or, in the future, perhaps a space voyage; (2) imposed risks that the 
individual can reasonably easily avoid, such as potential health risks due to food additives 
that can, given appropriate labeling, be avoided by purchasing other foods; (3) imposed 


‘In other areas, that is not always the case. For example, in some leadership positions a willingness 
to take risks is regarded as a strength, and in leisure activities such as computer games or sports, 
people often consciously seek risk. 
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risks that can only be avoided with considerable effort, e.g. in cases such as the decision 
of where to locate a waste incineration site, radioactive waste storage site or chemical 
factories—it is theoretically possible to move to another location, but only at great cost; 
and (4) imposed risks that cannot be avoided such as the hole in the ozone layer, gradual 
pollution of groundwater, soil degradation, accumulation of harmful substances in the 
food chain, noise, airborne particles, etc. 

The central risk-related ethical question is under which conditions assuming risks (in 
the active case) or imposing them on others (in the passive case) can be justified [11]. In 
many cases there is a difference between the actual acceptance of risks and the norma- 
tively expected acceptance, i.e. the acceptability of the risks [8, 9]. While acceptance rests 
with the individual, acceptability raises a host of ethical questions: Why and under what 
conditions can one legitimately impose risks on other people (Chap. 4)? The question 
gains yet more urgency when the potentially affected are neither informed of the risks nor 
have the chance to give their consent, e.g. in the case of risks for future generations. The 
objective of the ethics of risk [11] is a normative evaluation of the acceptability and 
justifiability of risks in light of the empirical knowledge about the type and severity of the 
harm, the probability of its occurrence and resilience (capacity for resistance) and in 
relation to a specific risk constellation.” 


30.2.2 Constellation Analysis for Risks 


Conventional questions as to the type and severity of the risk associated with particular 
measures or new technologies are therefore too general and obscure salient differentia- 
tions. An adequate and careful discussion of risks must be conducted in a context-based 
and differentiated manner and should, as far as possible, answer the following questions 
with regard to autonomous driving: 


— For whom can damages occur; which groups of people may be affected or suffer 
disadvantages? 

— How are the possible risks distributed among different groups of people? Are those 
who bear the risks different groups than those which would benefit from autonomous 
driving? 

— Who are the respective decision-makers? Do they decide on risks they would take 
themselves or do they impose risks on others? 

— What types of harm are imaginable (health/life of people, property damage, effects on 
jobs, corporate reputations, etc.)? 

— What is the plausibility or probability that the risks will occur? What does their 
occurrence depend on? 


?The results of Fraedrich/Lenz [6, S. 50] show that potential beneficiaries consider not only 
individual but also societal risks. 
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— How great is the potential scope of the risks of autonomous driving in terms of 
geographic reach and duration? Are there indirect risks, e.g. of systemic effects? 

— Which actors are involved in risk analysis, risk communication and the evaluation of 
risks, and what perspectives do they bring to the table? 

— What do we know about these constellations; with what degree of reliability do we 
know it; what uncertainties are involved; and which of those may not be possible to 
eliminate? 


In this way, ‘the’ abstract risk can be broken down into a number of clearly definable 
risks in precise constellations whose legitimation and justifiability can then be discussed 
individually in concrete terms. The societal risks of autonomous driving are made 
transparent—one could say that a ‘map’ of the risks emerges, representing an initial step 
towards understanding the overall risk situation in this field. Different constellations 
involve different legitimation expectations and different ethical issues, e.g. in terms of 
rights to information and co-determination [11, 15], but also different measures in the 
societal handling of these risks. 


30.3 Societal Risk Constellations for Autonomous Driving 


Societal risk constellations for autonomous driving comprise various aspects of possible 
harms and disadvantages, different social dimensions and varying degrees of plausibility 
of the occurrence of possible harms. 


30.3.1 Accident Risk Constellation 


One of the expected advantages of autonomous driving is a major reduction in the number 
of traffic accidents and thus less harm to life, health and valuables [5] (Chap. 17). This 
reduction is a major ethical matter [3]. Nevertheless, it cannot be ruled out that due to 
technological defects or in situations for which the technology is not prepared, accidents 
may occur which are specific to autonomous driving and which would be unlikely to 
occur with a human driver. One example of this could be unforeseen situations which are 
unmanageable for the automation in a parking assistant (Chap. 2). Even if only minor 
dents were the result here, it would have clear legal and financial repercussions that would 
have to be addressed. These would be all the more complex the greater the accident 
damage, e.g. in the case of a severe accident with a highway auto-pilot (Chap. 2). 

We are very familiar with auto accidents after more than 100 years of established 
automotive traffic. They involve one or a few vehicles, result in damage for a limited 
number of people and have limited financial effects. For this risk type of small-scale 
accidents, an extensive and refined system of emergency services, trauma medicine, lia- 
bility law and insurance is in place. Individual accidents caused by autonomous vehicles 
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can in large part presumably be handled within the existing system. However, the nec- 
essary further development of the legal framework is no trivial matter (see [7]). 

Accident risks of this type affect the users of autonomous vehicles as passengers. Users 
decide for themselves whether they wish to subject themselves to the risk by either using 
or not using an autonomous vehicle. But the accident risks of autonomous driving can also 
affect other road users, including, naturally, those who do not participate in autonomous 
driving. One can theoretically avoid these risks by not taking part in road traffic—but that 
would be associated with significant limitations. Thus dealing with the risks of autono- 
mous driving is a complex question of negotiation and regulation (Chaps. 4 and 25), in 
which not only the market, i.e. buying behavior, is decisive, but in which questions of the 
common welfare such as the potential endangerment of others and their protection must 
also be considered. This will require democratic and legally established procedures 
(registration procedures, authorities, checks, traffic regulations, product liability, etc.). 

These risks and also their complex distribution are not new; indeed they are omni- 
present in the practice of everyday traffic and also societally accepted. This is manifest in 
the fact that the currently more than 3000 annual traffic deaths in Germany, for example, 
do not lead to protests, rejection of car transportation or massive pressure for change. The 
latter component was different in the 1970s, when in West Germany alone over 20,000 
annual traffic deaths were recorded despite traffic volumes roughly a tenth of what they are 
today. Measures primarily aimed at improving passive safety were enacted, leading to a 
significant reduction in the death rates. Decisive for any societal risk comparison of the 
previous system with a future system including autonomous driving will be a substantial 
reduction in the total number of traffic accidents and the damage caused by them 
(Chaps. 17 and 21). The fact that autonomous driving will not suddenly replace the 
current system but will presumably be gradually integrated into the traffic system is, 
against this backdrop, a mixed blessing. On the one hand, mixed systems with human 
drivers and autonomously guided vehicles will presumably be of significantly greater 
complexity and unpredictability than a system completely switched-over to autonomous 
driving. On the other hand, gradual introduction into the transportation system will pro- 
vide the chance to learn from damage incidents and make improvements. The monitoring 
of damage incidents and cause analysis will be of critical importance here (Chap. 21). 

If the expectation is borne out that human-caused accidents drop substantially with the 
introduction of autonomous driving, liability law will gain additional significance as the 
share (albeit not necessarily the absolute number) of technology-caused accidents rises.” 
While today in most cases the cause of accidents is a human driver and therefore the 
liability insurance providers pay for damages, in accidents caused by an autonomous 
vehicle, the operator liability of the vehicle owner or the manufacturer’s product liability 
would apply (Chap. 26; see also [4, 7]). 


3This would, incidentally, also affect a major line of business in the insurance industry, third-party 
liability insurance. 
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30.3.2 Transportation System Risk Constellation 


On the system level, autonomous driving promises greater efficiency, reduced congestion 
and (albeit presumably only marginally; see [5, 13]) better environmental performance 
(Chap. 16). In the traditional transportation system, systemic effects and thus also potential 
risks arise primarily due to the available traffic infrastructure and its bottlenecks in con- 
junction with individual driver behavior and traffic volume. Individual situations such as 
severe accidents or construction zones can lead to systemic effects like traffic jams. 
Autonomous driving adds another possible cause of systemic effects to the existing ones: 
the underlying technology. The following will consider only autonomous vehicles relying 
on an internet connection (not on-board autonomous). 

Through the control software and the reliance on the internet (e.g. as part of the 
“internet of things”), new effects could emerge (Chap. 24). While in the automotive world 
to date vehicles are operated more or less independently of one another and mass phe- 
nomena only occur through the unplanned interactions of the individually guided vehicles, 
autonomously guided traffic will to some extent be connected through control centers and 
networking, e.g. to direct traffic optimally using interconnected auto-pilots (Chap. 2). The 
control of a large number of vehicles will in all likelihood be conducted through software 
that is identical in its fundamental structure, as the complexity and concentration of 
companies will presumably strongly limit the number of providers. This could, in theory, 
lead to the simultaneous breakdown or malfunctioning of a large number of vehicles based 
on the same software problem. These problems would then no longer necessarily be on a 
manageable scale in terms of geography, duration and scale of the damage as in the 
aforementioned accident cases, but could take on economically significant proportions. 

Insofar as autonomous vehicles are connected to each other in a network via internet or 
some other technology, the system of autonomous driving can be regarded as a coordi- 
nated mega-system. Its complexity would be extremely high, not least because it would 
also have to integrate human-guided traffic—the pattern constellation for systemic risks 
which are difficult or even impossible to foresee in which the risks of complex technology 
and software could combine with unanticipated human actions to create unexpected 
system problems [15]. 

A completely different type of system problem, in this case only for non-on-board 
autonomous systems but rather for networked vehicles, could be a sort of concealed 
centralization and an associated concentration of power. Since optimization on the system 
level can only be done through extra-regional control centers (Chap. 24), a certain degree 
of centralization—all decentralization on the user side notwithstanding—on the control 
and management level is indispensable. This could give rise to concerns that the neces- 
sities engendered by the technology could lead to problematic societal consequences: a 
centrally controlled traffic system as the precursor to a centralist society whose lifeblood 
was a ‘mega-infrastructure’ beyond the control of the democratic order. But this is not a 
foreseeable societal risk of autonomous driving and is not by any means a necessary 
development in this regard. Rather, this is more a concern of the type that should be borne 
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in mind as a potentially problematic issue during the establishment of autonomous driving 
so that, in the event of its emergence, countermeasures can be taken. 

In all of these fields, the decision-makers are a complex web of automotive companies, 
software producers, political regulators and agencies with different responsibilities. It is 
possible the new actors may also become involved whose roles cannot be foreseen today. 
Decision-makers and those affected are largely distinct groups. And since road users and 
other citizens would have practically no means of avoiding such risks, it is essential that 
an open, society-wide debate on these matters take place in order to observe and assess the 
development with due care and bring in any political or regulatory measures that may be 
appropriate. 


30.3.3 Investment Risk Constellation 


Research and development of the technologies of autonomous driving are extremely 
elaborate and accordingly cost-intensive. Suppliers and automotive companies are already 
investing now, and considerable additional investments would be required before any 
introduction of autonomous driving. As with other investments, the business risk exists 
that the return on investment may not be on the expected scale or in the expected 
timeframe due to autonomous driving failing to catch on a large scale for whatever reason. 
If a company opts not to invest in the technology, by contrast, there is the risk that 
competitors will pursue autonomous driving and, if it succeeds, vastly increase their 
market share. Thus strategic business decisions have to be made in consideration of the 
different risks. 

Upon first consideration this is a standard case of business management and a classic 
task for the management of a company. In view of the scale of the needed investments and 
the patience required for the development of autonomous driving, decisions made in this 
regard will have very long-term implications. Missteps would initially affect shareholders 
and employees of the respective companies, and if major crises were triggered by such 
failures the consequences could extend to the economy as a whole, for example in 
Germany with its heavy reliance on automotive companies. Although in principle a 
competitive situation, the scale of the economic challenge may speak in favor of forming 
strategic coalitions to design a joint standard base technology. 

Even after a successful market launch, mishaps or even technology-related system 
effects (see above) can occur which could pose a major risk for the affected brands 
(Chaps. 21 and 28). One issue that merits special mention in this context is the risk factor 
posed by the complexity of the software required for autonomous driving. Complex 
software is impossible to test in its entirety, which means that in actual use unexpected 
problems can occur (see Chap. 21 on the testability and back-up of the system). In this 
sense, use is essentially another test phase, and the users are testers. This is already the 
case to some degree in the automotive world, with software problems a relatively frequent 
cause of breakdowns. Whether drivers will accept being used as ‘test subjects’ in a more 
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expansive sense remains to be seen. Any such willingness would presumably be all but 
nonexistent in safety-related cases. When a computer crashes due to a software error, it is 
annoying. When an autonomous vehicle causes an accident due to a software error, it is 
unacceptable. In such cases—unlike with “normal” accidents—massive media attention 
could be expected. 

In particular due to the power of images and their dissemination through the media, 
such incidents can still have a major impact even when the issues are easily correctable 
and the consequences minor. A good example of this is the notoriety of the “moose test”, 
which came to public attention through publication of an incident on a test course. 
Another example is the story of the sustained damage to the reputation of Audi on the 
American market that resulted from a report in the US media in 1986 (Chap. 28). Irre- 
spective of the severity of the mishap, such incidents threaten to damage the company’s 
reputation and thus pose economic risks. Such risks are also present in the case of major 
recall actions, in which the substantial economic burden posed by the action itself is 
generally outweighed by the damage to the company’s reputation. The probability of such 
developments rises with the complexity of the required software, which thus emerges as a 
central aspect of the risks associated with autonomous driving. 


30.3.4 Labor Market Risk Constellation 


Technological and socio-technological transformation processes typically have labor 
market implications. Automation, in particular, is associated with concerns about the loss 
of jobs. The automation in production and manufacturing in the 1980s led to the loss of 
millions of jobs in Germany alone, primarily in the sectors dominated by simple manual 
tasks. A massive societal effort was required to prepare at least a portion of those affected 
by the job losses for new jobs through qualification and training. Today there are concerns 
that the next wave of automation could make even more sophisticated activities super- 
fluous. On the upside, moves towards greater automation can lead to the emergence of 
new fields of activity and job opportunities, so the overall balance need not be negative. 
But these new fields of activity are generally only open to people with higher 
qualifications. 

Comprehensive introduction of autonomous driving would undoubtedly affect the 
labor market. The primary losers would be drivers of vehicles which are currently man- 
ually operated: truck drivers, taxi drivers, employees of logistics and delivery companies, 
especially in the Vehicle-on-Demand’ use case (Chap. 2). A mobility system completely 
converted to autonomous driving could in fact largely do without these jobs altogether. On 
the other side of the equation, new jobs in the control and monitoring of autonomous 
traffic could emerge, and highly qualified personnel would be needed in the development, 
testing and manufacture of the systems, particularly in the supplier industry. 

Thus a similar scenario to the one described above for the previous waves of 
automation would emerge here as well: elimination of unskilled jobs and the creation of 
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new, highly skilled positions. The net outcome in jobs is impossible to predict from this 
vantage point. What is clear is that the high number of potentially affected jobs makes it 
imperative to think about pro-active measures to deal with the development at an early 
stage, e.g. developing and providing qualification measures. As it may be presumed that 
the integration of autonomous driving into the current transportation system will occur 
gradually, and because there is a wealth of experience from previous automation pro- 
cesses, the prerequisites for an effective response should be in place. To identify devel- 
opments that could be problematic for the labor market at an early stage, research and 
cooperation on the part of unions, employers and the employment agency to observe 
current develops is required. 


30.3.5 Accessibility Risk Constellation 


Autonomous driving promises greater accessibility for people with reduced mobility, such 
as the elderly. While this is clearly on the plus side from an ethical standpoint, it could 
also have social justice implications which, as “possible harms,’ could be regarded as 
risks. This includes primarily the occasionally voiced concern regarding increased costs of 
individual mobility due to the costs of autonomous driving. In a mixed system this 
concern could be countered with the argument that the traditional alternative of driving 
oneself still exists and thus that no change for the worse would occur. 

This scenario would beg the question, however, of who would actually profit from the 
benefits—primarily safety and convenience—of autonomous driving. If the sole effect of 
autonomous driving were simply to enable those who currently have the means to employ 
a chauffeur to dispense with their chauffeurs and even save money in the process in spite 
of the higher up-front and operating costs, this would certainly not promote greater 
accessibility to mobility in general. Indeed, it would be detrimental if a large share of 
those who currently drive themselves were unable to afford to participate in autonomous 
driving. When considering such problematic developments, it must be noted, first, that 
questions of distributive justice are not specific to autonomous driving; the just distri- 
bution of the benefits of new technologies is a fundamental question with regard to 
technological advancement. Second, these concerns remain speculative at present as no 
reliable cost information is available. 

Social justice issues could arise in relation to the costs of any infrastructure to be 
established for autonomous driving [5, p. 12] [13]. If it were regarded, for example, as a 
public responsibility and were funded through tax moneys, non-users would also take part 
in financing autonomous driving. If the costs were borne by all drivers, non-users would 
also regard themselves as subsidizing autonomous driving. Depending on how high the 
infrastructure costs and thus the costs for individuals were, this could also give rise to 
social justice questions relating to the distribution of the costs. 
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30.3.6 Privacy Risk Constellations 


Even today modern automobiles provide a wealth of data and leave electronic trails, e.g. 
by using a navigation aid or through data transmitted to the manufacturer. If autonomous 
vehicles were not on-board autonomous but had to be connected at all times, the electronic 
trail would amount to a complete movement profile [13]. Of course the movement profiles 
of vehicles do not necessarily have to be identical to the movement profiles of their users. 
In the case of vehicles on demand (Chap. 2) it is of course possible to imagine that they 
could be used anonymously if ordering and payment were conducted anonymously— 
which, however, seems rather inconsistent with the current development toward electronic 
booking and payment systems. 

Movement profiles provide valuable information for intelligence services, which could 
for instance track the movements of regime opponents, but also for companies, which 
could use such information to create profiles for targeted advertising. In view of the 
increasing digitalization and connectedness of more and more areas of our social and 
personal lives, the specific additional digitalization in the field of autonomous driving 
would presumably represent just one element among many others. The problem—even 
today the end of privacy is declared with regularity—is immensely larger, as current 
debates about the NSA, industry 4.0 and Big Data show. The emergence of a converging 
mega-structure comprising the transportation system, supply of information, communi- 
cation systems, energy systems and possibly other, currently independently functioning 
infrastructures, represents one of the biggest challenges of the coming years or even 
decades. The issue will be to re-define the boundaries between privacy and the public 
sphere and then actually implement those decisions. This must be done on the political 
level and is of fundamental significance for democracy as a concept, for absolute trans- 
parency is but the flip-side of a totalitarian system. Autonomous driving is presumably of 
only minor specific significance in this debate. 


30.3.7 Dependency Risk Constellation 


Modern societies are increasingly dependent on the smooth functioning of technology. 
This begins with the dependency on personal computers and cars and extends to the 
complete dependency on a functioning energy supply and worldwide data communication 
networks and data processing capabilities as prerequisites for the global economy. 
Infrastructures that are becoming more complex, such as the electricity supply, which 
increasingly has to deal with a fluctuating supply due to renewable energy sources, now 
more frequently engender ‘systemic risks’ [15] in which small causes can lead to system 
instability through complex chain reactions and positive feedback. This increasingly 
frequently discussed susceptibility to technical failure and random events, but also ter- 
rorist attacks on the technological infrastructure of society (e.g. in the form of a 
cyber-terror attack on the information technology backbone of the globalized economy) 
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represents an unintended and undesirable, yet ultimately unavoidable consequence of 
accelerated technological advancement [10]. At issue are risks that emerge more or less 
gradually, which in many cases are not consciously accepted in the context of an explicit 
consideration of risk versus opportunity but instead only come to public attention when 
the dependency becomes tangible, such as during a lengthy blackout, which would 
incapacitate practically every venue of public life [12]. 

In the case of a large-scale shift of mobility capacity to autonomous driving, a high 
proportion of society’s mobility needs would naturally depend on the functioning of this 
system. A breakdown would be manageable as long as there were enough people who 
could still operate the vehicles manually. In a system that allowed passenger vehicle traffic 
to switch from autonomous to manual, for example, this would be no problem. But if a 
large share of the logistics and freight traffic were switched over to autonomous systems, it 
would be implausible, in the case of a longer-term total breakdown of the system, to 
maintain a sufficient pool of drivers, not to mention the fact that the vehicles would have 
to be equipped to enable manual operation in the first place. Even if significant logistics 
chains were to be interrupted for a lengthy period due to a system failure, bottlenecks 
could still quickly form, both in terms of supplying the population and maintaining 
production in the manufacturing industries [12]. This type of risk is nothing new: the 
massive dependence on a reliable energy supply that has been the object of much dis- 
cussion since Germany’s energy transformation policy came into effect, as well as the 
dependence of the global economy on the internet, are structurally very similar. 

Another form of dependence can arise from autonomous driving on the individual level 
through the atrophying of skills. Large-scale use of autonomous vehicles would result in 
the loss of driving practice. If the vehicles are then operated manually, e.g. on weekends 
or on vacation, the reduced driving practice—a certain dependence on autonomously 
guided vehicles—could result in lower skill levels, such as the ability to master unex- 
pected situations. In the case of a total breakdown of the system, there would suddenly be 
large numbers of manually operated vehicles on the roads, in which case the reduced skill 
of the drivers could once again prove problematic. Moreover, there would presumably be 
major bottlenecks and traffic jams if the expected efficiency gains on the system level (see 
above) were suddenly to disappear. 

Finally, the further digitalization and transfer of autonomy to technical systems would 
increase society’s vulnerability to intentional disruptions and external attacks. Autono- 
mous driving could be affected by terrorists, psychopaths or indeed military scenarios 
(cyber warfare). Control centers could be hacked, malware installed, or even a system 
collapse triggered through malicious action. Defensive measures are of course necessary 
and technically feasible; but here we run into the notorious ‘tortoise and hare’ problem. 
But here again, this is not a problem specific to autonomous driving; it is known in the 
internet world and has arrived in the energy sector, for example, as well. 
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30.3.8 On the Relationship Between Risk Constellation 
and Introduction Scenario 


The risk constellations described here are based on qualitative and exploratory consid- 
erations from the current world of mobility. They therefore have a certain plausibility, but 
also contain speculative aspects. They should not be understood as predictions, but as 
guideposts that should be observed along the way to the research, development and 
introduction of autonomous driving. Indeed, they cannot be predictive because any future 
occurrence of particular risk constellations depends on the introduction scenario for 
autonomous driving and its specific characteristics, and both of these elements are 
unknown today. For example, the contours of the ‘privacy’ risk constellation will depend 
heavily on whether an on-board autonomous driving scenario is implemented or auton- 
omous vehicles continuously need to be connected to the internet and control centers. 

The public perception of the risk will depend largely on how autonomous driving is 
introduced. If it happens as part of a gradual automation of driving, the potential to learn 
gradually from the experiences gained along the way will greatly lessen the risk of a 
‘scandalization’ of autonomous driving as a high-risk technology for passengers and 
bystanders. Steps on the way to further automation such as Traffic Jam Assist, Automated 
Valet Parking or Automated Highway Cruising (Chap. 2), the introduction of which seems 
likely in the coming years (Chap. 10), would presumably not lead to an increased per- 
ception of risk because they would seem a natural development along the incremental path 
of technological advancement. 

Unlike switching on a nuclear reactor, for example, the process of increasing driver 
assistance towards greater automation has so far progressed gradually. The automatic 
transmission has been around for some decades, we are comfortable with ABS, ESP and 
parking assistants, and further steps towards a greater degree of driver assistance are in the 
works. Incremental introduction allows for a maximum degree of learning and would also 
enable gradual adaptation of the labor market, for example, or privacy concerns (see 
above). 

In more revolutionary introduction scenarios (Chap. 10) other and likely more vexing 
challenges would present themselves for the prospective analysis and perception of risks. 
The public perception would then react especially sensitively to accidents or critical 
situations, the risk of ‘scandalization’ would be greater and the ‘investment’ risk con- 
stellation (see above) could develop into a real problem for individual suppliers or brands. 


30.4 Relationship to Previous Risk Debates 


Germany and other industrialized countries have extensive experience with acceptance 
and risk debates over many decades. This section will seek to draw insights from these 
previous risk communications and apply them to autonomous driving—insofar as this is 
possible in light of the very different risk constellations. 
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30.4.1 Experience from the Major Risk Debates 


30.4.1.1 Nuclear Power 

The risk constellations for nuclear energy arose principally from the fact that one side was 
comprised of the decision-makers from politics and the business community, supported by 
experts from the associated natural science and engineering disciplines. On the other side 
were the affected parties, including in particular residents in the vicinity of the nuclear 
power plants, the reprocessing plant and the planned nuclear waste repository in Gorleben, 
but also growing numbers of the German populace. 

Nuclear power is a typical technology that is far-removed form everyday experience. 
Although many people profit from the generated energy, the source of the energy is not 
visible, as evidenced by the old saying that “electricity comes from the electrical socket.” 
The possibility of a worst-case scenario with catastrophic damage potential like in 
Chernobyl and Fukushima; the fact that on account of those incidents no insurance 
company was or is willing to insure nuclear power plants; the extremely long-term danger 
posed by radioactive waste; all of these factors demonstrate that the risk constellation in 
the case of nuclear power is completely different than the one for autonomous driving. 
Only one point was instructive: 

The early nuclear power debate in Germany was characterized by the arrogance of the 
experts, who at that time were almost entirely in favor of nuclear power, in the face of 
criticism. Concerns among the public were not taken seriously, and critics were portrayed 
as irrational, behind the times or ignorant [14]. In this way, trust was squandered in several 
areas: Trust in the network of experts, politicians and business leaders behind nuclear 
energy; trust in the democratic process; and trust in technical experts regarding com- 
mercial technologies in general. The risk debate on nuclear energy illustrates the 
importance of trust in institutions and people and how quickly it can be lost. 


30.4.1.2 Green Biotechnology 

The risk constellation in the debate over green biotechnology is interesting in a different 
way. In spite of a rhetorical focus on risks, for example through the release and uncon- 
trolled spread of modified organisms, the actual topic here is less the concrete scale of the 
risk and more the distribution of risks and benefits. Unlike with red biotechnology, the end 
consumer in this case would have no apparent benefit from genetically modified food. In 
the best case, the genetically modified foods would not be worse than conventionally 
produced foods. The benefits would accrue primarily to the producing companies. In 
terms of potential health risks (e.g. allergies), however, the converse would be the case: 
they would affect users. That is naturally a bad trade-off for users: excluded from the 
benefits, but exposed to potential risks. This viewpoint could present a plausible expla- 
nation for the lack of acceptance and offer a lesson for autonomous driving, i.e. not to 
emphasize abstract benefits (e.g. for the economy or the environment) but to focus on the 
benefits to the “end customer’. 
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A second insight also emerges. The attempt by agribusiness companies, and in par- 
ticular Monsanto, to impose green biotechnology in Europe only intensified the mistrust 
and opposition. In sensitive areas such as food, pressure and lobbying raise consumer 
consciousness and lead to mistrust. Attempting to ‘push through’ new technologies in 
fields that are close to everyday experience, which driving undoubtedly is, therefore seems 
like an inherently risky strategy. 


30.4.1.3 Mobile Communication Technologies 

Mobile technologies (mobile phones, mobile internet) are an interesting case of a tech- 
nology introduction that is successful in spite of public risk discussions. Although there 
has been a lively risk discussion regarding electromagnetic radiation (EMF), this has had 
no adverse affect on acceptance on the individual level. Only locations with transmission 
towers are the focus of ongoing protests and opposition. There is practically no opposition 
whatsoever to the technology in itself. The most obvious explanation is that the benefit— 
and not the benefit to the economy, but the individual benefit experienced by each user— 
is simply too great. 

Even the serious and publicly discussed risks to privacy that have come to light in 
recent years due to spying by companies and intelligence services have had barely any 
impact on consumer behavior. Mobile telephony, online banking, e-commerce and the 
perpetually-online lifestyle enable the creation of eerily accurate profiles, and yet this does 
not prevent users from continuing to use these technologies and continuously volunteer 
private information in the process. It is plainly the immediate benefit that moves us to 
accept these risks even when we know and criticize them. 


30.4.1.4 Nanotechnology 

Ever since a risk debate about nanotechnology emerged some 15 years ago, the tech- 
nology has been dogged by concerns that it could fall victim to a public perception 
disaster similar to the ones experienced by nuclear energy or genetically modified crops. 
The extremely wide-ranging, but entirely speculative concerns of the early days, which 
took the form of horror scenarios such as the loss of human control over the technology, 
have since disappeared from the debate without these effects coming into play. Through 
open debate, nanotechnology emerged from the speculative extremes between rapturous 
expectations and apocalyptic fears to become a ‘normal’ technology whose benefits reside 
primarily in new material characteristics achieved through the coating or incorporation of 
nanoparticles. 

Here again there were fears of large-scale rejection of the technology. Calls by orga- 
nizations such as the ETC-Group and BUND for a strict interpretation of the precautionary 
principle, for example in the form of a moratorium on the use of nanoparticles in con- 
sumer products such as cosmetics or foods, gave voice to such concerns. Yet a funda- 
mentalist hardening of the fronts did not occur despite the evident potential. One reason is 
presumably that communication of the risk proceeded much differently in this case than 
with nuclear technology and genetic engineering. While in those cases experts initially 
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failed to take concerns and misgivings seriously, dismissing them as irrational and con- 
veying a message of “we have everything under control,” the risk discussion concerning 
nanotechnology was and remains characterized by openness. Scientists and representa- 
tives of the business community have not denied that further research is still needed with 
regard to potential risks and that risks cannot be ruled out until the toxicology is more 
advanced. This helped build trust. The situation could be described somewhat paradox- 
ically as follows: Because all sides have openly discussed the need for further research and 
potential risks, the debate has remained constructive. The gaps in the science regarding 
potential risks has been construed as a need for research rather than cause for demanding 
that products with nanomaterials be barred from the market. Rather than insisting on the 
absolute avoidance of risks (zero risk), trust that any risks will be dealt with responsibly 
has been fostered. 


30.4.2 Conclusions for Autonomous Driving 


Autonomous driving will be an everyday technology that is as closely connected to 
people’s lives as driving is today. That distinguishes it greatly from nuclear energy, while 
it shares this everyday-life quality with green biotechnology (through its use in food 
production) and mobile communication technology. From both risk debates we may 
extract the insight of how central the dimension of individual benefit is. While any such 
benefit from eating genetically modified food has scarcely even been advanced by its 
proponents, the individual benefits of mobile telephones and mobile internet access are 
readily evident. And as soon as this benefit is demonstrably large, people are prepared to 
assume possible risks. And this is absolutely rational from an action theory standpoint. 
What is irrational is to assume risks when the benefits are not evident or would only 
accrue to other actors (e.g. Monsanto in the green biotechnology debate). In such cases a 
risk debate can have dramatic consequences and obliterate any chance of acceptance. 

Another such knock-out scenario is the possibility of a massive catastrophe such as the 
‘residual risk’ of the meltdown of a nuclear power facility. This was decided on the 
political level, albeit with little chance of external influence. The situation was thus widely 
regarded as a passive risk situation in which people were exposed to potential harm by the 
decisions of others. Nothing can be gleaned directly from this scenario for autonomous 
driving as it would presumably be introduced in the familiar market context of conven- 
tional transportation and thus de facto depend on the acceptance of users from the outset. 
While it is possible to imagine other introduction scenarios (Chap. 10), state-mandated use 
of autonomous driving is all but unthinkable. The only indirect lesson from the history of 
nuclear energy is that expertocratic arrogance generates mistrust. An open discussion 
‘between equals’—a lesson from the nanotechnology debate as well—is a key precon- 
dition for a constructive debate on technology in an open society. 

These examples also show that talk of a German aversion to technology is a myth born 
of the experiences with nuclear energy and genetic engineering. All empirical studies 
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show that otherwise, acceptance is very high across a large spectrum of technology 
(digital technologies, entertainment technology, new automotive technologies, new 
materials, etc.) [1]. This also applies to some technologies for which intensive risk debates 
have taken place in the past or are still ongoing (e.g. mobile telephones). The fact that 
nowadays questions regarding risks are immediately posed does not indicate hostility to 
technology; rather, it is a reflection of the experience of the ambivalent character of 
technology and the desire to obtain as much information as possible. Much that is 
commonly taken as evidence of hostility to technology has little to do with technology. 
The Stuttgart21 protests were not about rejecting rail technology; protests against new 
runways at major airports are not about rejecting aviation technology; nor are protests 
against highways and bypasses about rejecting the technology of driving cars. Even the 
rejection of genetically modified crops and nuclear energy have much to do with 
non-technological factors: mistrust of multinational corporations like Monsanto and a lack 
of confidence in adequate control and monitoring (e.g. Tebco in Japan). 


30.5 Strategies of Responsible Risk Management 


Risk management must be adapted to the respective risk constellations and be conducted 
on the appropriate levels (public debates, legal regulations, politically legitimated regu- 
lation, business decisions, etc.). It is based on the description of the risk constellation, 
in-depth risk analyses in the respective fields and a societal risk assessment. 


30.5.1 Risk Evaluation 


The societal risk assessment is a complex process involving a variety of actors that can 
take on its own dynamics and lead to unforeseeable developments [15]. Starting with 
statements by especially visible actors (in the case of new technologies, frequently sci- 
entists and businesses on the one hand and pressure groups and environmental groups on 
the other) leads to a gradual concentration of positions and point-counterpoint situations in 
the mass media and the public debates represented by them. Individual incidents can tip 
public opinion or dramatically accelerate developments, as seen in the rapid shift of 
attitudes about nuclear energy following the reactor incidents in Chernobyl and 
Fukushima. That makes predictions extremely difficult. The following will venture a 
tentative statement on autonomous driving in consideration of the plausibility and the 
lessons drawn from the previous debates. 

To begin with, it is important to note that comparisons are very important for risk 
assessments [8, 13, 15]. We evaluate new forms of risk by looking at them in relation to 
known forms of risk. Here we have a known risk constellation shared by autonomous 
driving and conventional driving that can and should be applied as a key benchmark for 
comparison (Chap. 28; see also Sect. 30.3 in this paper). If autonomous driving were to 
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score significantly and unambiguously better in this comparison (i.e. greater safety, lower 
risk of accidents), this would be a very important factor in the societal risk assessment. 

Moreover, the risks of autonomous driving appear to be relatively minor in many 
respects. Technology-related accidents would occur with a certain probability, which 
could be minimized, but not eliminated, in an intensive test phase. Unlike in the case of 
nuclear energy, for example, their consequences would be relatively minor in geographic 
and temporal terms (compare the half-lives of radioactive materials) as well as with 
respect to the number of involved people and the property damage. A worst-case scenario 
of catastrophic proportions does not apply. 

Largely new is the digital networking potentially associated with the automation of 
driving, with all of its implications for possible systemic risks, vulnerabilities, privacy and 
surveillance. These will inevitably be major issues in any public debate on autonomous 
driving. But as these challenges are also present in a multitude of other fields (including, 
increasingly, non-autonomous driving), they would be unlikely to lead to risk concerns 
relating specifically to autonomous driving. 

One special case is the business risk assessment by manufacturers (Sect. 3.3), both in 
terms of the return on investment and potential reputation problems due to accidents. Any 
such business assessment must work with extremely uncertain assumptions, for instance 
concerning the media’s willingness to play up scandals as well as the effect of any such 
scandals in themselves. Here misperceptions can arise in both directions: exaggerated 
fears and naive optimism. It is to be expected, in any event, that from the public per- 
spective, scandals would be specifically attributed to a particular brand rather than to 
autonomous driving as an abstract concept. That may hold no consolation for the affected 
brand; but it does indicate—at least insofar as the benefits of autonomous driving are 
undisputed—that this type of problem would impact the competition between the man- 
ufacturers, but not autonomous driving as a technology in itself. And that is already the 
case for other technologies today. 

Overall, the public risk constellation tends towards being unproblematic. It cannot be 
compared with genetic engineering or nuclear technology: there is no catastrophic sce- 
nario, the benefit is readily apparent, the introduction proceeds through a market and not 
by decree ‘from above’. And it would probably not occur overnight ‘at the flip of a 
switch,’ but gradually. 


30.5.2 Risk and Acceptance 


Acceptance (Chap. 29) cannot be ‘manufactured,’ as is sometimes expected, but can only 
‘develop’ (or not). This ‘development’ depends on many factors, some of which can 
certainly be influenced. In rough terms, public as well as individual acceptance depend 
largely on perceptions of the benefits and risks. It is crucial that the expected benefits not 
be couched exclusively in abstract macroeconomic terms, but actually comprise concrete 
benefits for those who would use the new technologies. Also critical is the ability to 
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influence whether or not one is exposed to risks. Acceptance is generally much easier 
when the individuals can choose for themselves (e.g. to go skiing or not) than when 
people are exposed to risks by external entities and are thus effectively subjected to the 
control of others. 

Another important factor with respect to risk concerns is a (relatively) just and com- 
prehensible distribution of benefits and risks (this was the main problem in the genetic 
engineering debate; see above). And it is absolutely essential that the involved institutions 
(manufacturers, operators, regulators, monitoring and control authorities) enjoy public 
trust and that the impression does not arise that there is an effort to ‘push the thing 
through’ on the backs of the affected with their concerns. To achieve this, communication 
about possible risks must be conducted in an environment of openness—nothing is more 
suspect from a mass-media standpoint than to assert that there are no risks and that 
everything is under control. Concerns and questions must be taken seriously and must not 
be dismissed a priori as irrational. All of this requires early and open communication with 
relevant civil society groups as well as in the mass media sphere, and where appropriate in 
the spirit of ‘participatory technology development.’ 

There is some reason to believe that for the acceptance of autonomous driving, 
expected benefits will outweigh concerns regarding risks. After all, conventional driving is 
an almost universally accepted technology in spite of over 3000 traffic deaths annually in 
Germany. In contrast with nuclear energy, for example, the scope of potential damage 
appears limited both geographically and in terms of time. Other societal risks (see above; 
e.g. surveillance) are more abstract in nature, while the expected benefits are, in part, very 
tangible. I would therefore turn the juxtaposition “abstract social gain - concrete human 
loss” (Chap. 27) on its head: abstract risks such as dependence on complex technologies 
or privacy problems versus concrete individual benefits in terms of safety and comfort. 
A focus on risks would therefore presumably miss the core of the challenge: the decisive 
factor seems to be the expected benefits. 

That only applies, of course, because the risk assessment identified no dramatic results. 
Instead, the risk constellation for autonomous driving represents “business as usual” in the 
course of technological advancement—undoubtedly with its trade-offs and societal risks, 
but also with the opportunity to deal with them responsibly and civilly. In particular the 
presumably gradual introduction of autonomous driving and the resultant opportunity to 
learn and improve in conjunction with the absence of catastrophic-scale risks somewhat 
diminish the importance of risk questions in the further course of the debate on autono- 
mous driving in relation to, say, labor market or social justice concerns. Rather than 
focusing on risk, it seems appropriate to regard the elements and options of autonomous 
driving as parts of an attractive mobility future with greater safety and efficiency, more 
social justice and more convenience/flexibility. Of course, there is no zero-risk scenario— 
but that has not been the case with conventional driving either. 

Two major acceptance risks remain. One is the possibility of scandalization of prob- 
lems in test drives or technical failures, perhaps in the context of accidents, through media 
reporting (read moose test). The consequences would be difficult to predict. But here again 
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it must be noted that the moose test did not give rise to rejection of the technology of 
driving in itself. The problem—presuming the correctness of the assumption that expected 
benefits are more important for acceptance than risk concerns—would be more that any 
reputational damage would affect the respective brands rather than the technology of 
autonomous driving in itself. 

The second big unknown is human psychology. Whether and to what degree people 
will entrust their lives and health to autonomous driving is an open question. There are no 
known cases of acceptance problems for other autonomous transportation systems such as 
subways or shuttle services. But railway vehicles are perceived differently than cars; 
because in rail transport one is always driven rather than driving oneself; because the 
respective systems are controlled centrally by the control system; and because the com- 
plexity and possibility of unforeseen events in many situations is considerably greater in 
automobile traffic than in railway cars. 

Another aspect with regard to acceptance is that in conventional automobile trans- 
portation a well-developed culture of damage adjustment is in place through the traffic 
courts, appraisers and insurance companies that has reached a high degree of precision and 
reliability. Autonomous driving, by contrast, would pose new challenges to the damage 
adjustment system as the question of “Who caused the damage, man or machine?” would 
have to be answered in an unambiguous and legally unassailable manner. Acceptance of 
autonomous driving will therefore largely depend on the development of answers to these 
questions that are equal to the precision of today’s damage adjustment system (Chaps. 4 
and 5). 


30.5.3 Elements of Societal Risk Management 


This diagnosis of the risk constellation for autonomous driving from the societal per- 
spective suggests, indeed demands, the following risk management measures: 


— Registration criteria for autonomous vehicles must be defined by the responsible 
authorities; with regard to safety standards, both fundamental ethical questions (how 
safe is safe enough?) and political aspects (e.g. distributive justice, data protection) 
must be taken into account and handled on the legislative/regulatory level as 
appropriate. 

— Key will be the legal regulation of dealing with the possible and small-scale accidents 
in autonomous driving, and in particular adjustment processes. Product liability in 
particular will have to be resolved (Chaps. 25 and 26). 

— Adaptation or expansion of the current traffic laws would have to be considered in this 
context. 

— The change would affect driving schools with regard to the competences required for 
users of autonomous vehicles, and in particular for the switch from ‘manual’ to ‘au- 
tonomous’ mode and vice versa. 


30 Societal Risk Constellations for Autonomous Driving ... 661 


— Crucial for risk management are safety measures to ensure both that autonomously 
guided vehicles can safely stop in critical situations and that they provide passive 
protection for occupants in the event of an accident. 

— From this perspective, dispensing with passive safety measures such as seatbelts and 
airbags would only be legitimate once sufficient positive experience had been gained 
with autonomous driving to justify such a move. This idea should therefore not be 
presented as a prospect too early in the process. 

— The expected gradual introduction of the technologies of autonomous driving opens up 
a variety of possibilities for monitoring and ‘improving on the job.’ Their use in the 
form of new sensor and evaluation technologies should be an important element of the 
societal risk management scenario (Chaps. 17, 21 and 28). 

— Risks for the labor market should be observed closely; if job losses are foreseeable, 
early action should be taken to arrange educational and re-training opportunities for 
those affected. 

— Significant problems with data protection and privacy are to be expected if autono- 
mous driving takes place within networked systems (although autonomous driving 
does not pose specific issues in this regard compared to other fields). Technical and 
legal measures (Chap. 24) should be introduced here to take account of the 
wide-ranging public debate on these issues (e.g. NSA, indiscriminate data collection). 

— In terms of innovation and business policy, it is incumbent upon national governments 
to discuss with the automobile manufacturers adequate distribution of the business 
risks that would cause major economic damage in the event of adverse incidents, e.g. 
damage to a company’s reputation due to highly publicized breakdowns or accidents. 

— As for risk management in relation to public communication and information policy, 
the aforementioned lessons from the debates on nuclear energy and nanotechnology 
are instructive with regard to the need to establish trust. 

— Involving stakeholders is naturally important and decisive for the societal introduction, 
or ‘adoption,’ of autonomous driving. This would include principally the drivers’ 
associations which are so influential in Germany. In terms of public opinion, the mass 
media play a crucial role. Consumer protection is naturally also an important 
consideration. 

— For modern technology development, it is critically important that it not be conducted 
entirely within a more or less closed world of engineers, scientists and managers, 
which is then obliged to plead for acceptance of its own developments after the fact. 
Instead, the development process—at least the parts which do not directly affect the 
competitive interests of the companies—should take place with a certain degree of 
openness. The aforementioned stakeholders should be involved in the development 
process itself and not just in the later market-launch phase. Ethical questions about 
how to deal with risks and legal questions regarding the distribution of responsibility 
should be examined in parallel with the technical development and publicly discussed. 
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Many of the challenges mentioned here are of a complex system type. In this respect, 
system research on various levels is especially important. Autonomous driving should not 
be regarded simply as a replacement of today’s vehicles by autonomously guided ones, 
but as an expression of new mobility concepts in a changing society. 
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Taking a Drive, Hitching a Ride: 31 
Autonomous Driving and Car Usage 


Eva Fraedrich and Barbara Lenz 


31.1 Introduction 


For over a century, the automobile has shaped our physical mobility like no other means 
of transport. For almost as long, however, it has also been the subject of criticism sur- 
rounding the ecological, social and health consequences of automobility. 

Autonomous driving may bring with it upheaval in how individuals and society deal 
with the car, and thus also impact transport, mobility or urban structures. Recently, it has 
received much public attention—in the mass media it has become part of regular news 
reporting and is even taken up, discussed and shared on social platforms. There is public 
discussion of how technology is currently (perceived) to be developing, but also of the 
possible radical change in how cars will be used, which would be accompanied by altered 
attitudes to cars and driving. Expected changes, for instance, include a dramatic drop in the 
current rate of car ownership [1, 2], a reduction in the space currently needed for parking 
[3], and a transformation in car ownership and usage in favor of carsharing fleets [4]. 

The topic’s growing prominence demonstrates that the debate surrounding autonomous 
driving and autonomous vehicles is evidently cropping up more and more in society. In 
any transition to a potential new era of car ownership and usage, it is important to ask 
early on what people associate with autonomous driving. How do they perceive the 
technology and the ensuing debate? In what contexts is such a debate embedded? What 
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are people’s hopes, fears, and fantasies? Where is the technology viewed with optimism or 
skepticism, as being feasible or even as impossible? 

An initial systematic in-depth structuring of the topic from road users’ point of view 
has focused on the wealth of various topics, perceptions, and assessments presently 
associated with autonomous driving (for details of this exploratory study’s survey and 
findings see Chap. 29). In this connection, it has become clear that autonomous driving is 
assessed strongly from a subjective usage context, and is also tightly bound up with the 
motives, value systems, and practices of using private cars. The choice of transport mode 
—the decision to use a particular transport means—is in turn a deeply rooted part of our 
everyday praxis, which can be expected to change little by little rather than by leaps and 
bounds (cf. [5, 6]). It is not currently clear what a future with autonomous vehicles might 
look like, and which areas of our daily lives, communal life, or mobility will be subject to 
change. Examining autonomous driving within the scope of everyday practices, of which 
car usage and ownership form part makes the context of the technology more conceivable. 

This article first looks at the latest research on car use and ownership. Using selected 
findings from previous surveys, we then direct the focus to use-related perspectives on 
autonomous driving (these perspectives specifically refer to the use cases developed 
within the Villa Ladenburg project see Chap. 2). In this context, we will also examine the 
role of motivations for using and owning cars. 


31.2 We Drive ... and Drive ... and Drive ... 


The question of why people use cars has occupied scientists of various disciplines— 
including psychology, sociology, transportation science, economics and social sciences in 
particular—for almost as long as the automobile has been in existence [7]. This debate has 
been a highly emotional one again and again (cf. [7, 8]); literature and studies on the 
individual and societal benefits of car usage are clearly in the minority (see [9, 10]). In 
light of the discussion of more sustainable ways of living, to which reducing motorized 
personal transport could significantly contribute, the search for the reasons behind car 
usage has intensified in recent years, which can be seen in the increasing numbers of both 
academic and popular-science papers and articles on the subject. 

The automobile is part of a complex, non-linear system—the system of automobility— 
which always reproduces the preconditions for its own expansion (which can be seen in 
potent and complex technical, political and social relationships between industry, sup- 
pliers, infrastructure, resource use, and urban and regional planning etc. [11]). This has led 
to the onset of path dependency and a “lock-in” effect which can hardly be reversed (see 
[11-13]). Stotz (2001) points out how the car as a technical artifact is actively integrated 
into social and societal (socialization) processes, and in this way acquires the status of 
subject rather than of an object (see [14]). Other authors have also remarked that the car 
itself has not appeared to be an external object for quite some time now, but rather seems 
to be a symbolic extension of the human body (see [15-17]). There are also a series of 
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studies, however, that highlight the car’s significance for physical and mental well-being, 
and even for higher life expectancy (see [18-20]). 

The motivations that have been empirically uncovered for using or owning a car are 
manifold. In the following, we shall briefly outline the foremost and most up-to-date 
attempts at explanation. 


31.2.1 What Are the Reasons and Motives for Using Cars? 


Instrumental motives 

For a long time, the motives for using and owning cars was explained by behavioral 
models mainly based on instrumental or utilitarian aspects (see [21]). In order to fulfill 
their everyday mobility needs—that is to say, to undertake various activities at various 
locations—people resort to several means of getting around (car, bike, train, etc.). The 
reasons for this, goes the assumption, are based on the specific benefits they bring with 
them, e.g. availability, speed, monetary costs, flexibility, safety, convenience, etc. Who- 
ever, therefore, chooses the car to get around—when, for example, desiring to get from A 
to B more quickly, or setting off on holiday in as good-value and comfortable a way as 
possible, or getting to work when it is far from home—deems it more favorable than other 
transport means. Whether the advantages a car brings are objectively measurable is a 
secondary matter here; what is at issue is a subjectively perceived benefit, which need not 
correspond to any actual one (see [22]). 

Urban development concepts such as “New Urbanism” or “Smart Growth” primarily 
involve the assumption that instrumental aspects are decisive in how transport modes are 
chosen. This then shapes infrastructural, transport-planning, and policy activities—areas 
with greater settlement density and mix of uses (residential, work, shopping, leisure) aim 
to shorten trip lengths and times, and should enable a reduction in motorized private 
transport (see [23-26]). 


Affective motives 
Instrumental reasons alone, however, are not sufficient in themselves to fully explain 
decisions made when choosing transport modes [27, 28]. Furthermore, they cannot always 
be clearly distinguished from other motives. Independence and freedom, the dominant 
reasons for using cars, can both be interpreted as instrumental and affective aspects. The 
freedom—free from timetables, for example—to drive off at any moment can be a rational 
basis for taking the car. At the same time, this freedom can also give a feeling of autonomy 
and independence—an emotionally colored reason to drive (see [6, 29]). 

Affective or emotional factors play a significant role in both everyday driving and 
journeys made for leisure. Transport means such as the car are tightly bound up with 
emotions and feelings that in turn exert considerable influence on what modes are, and are 


668 E. Fraedrich and B. Lenz 


not, selected. This is the case even though car users are often inclined, in direct surveys, to 
rationalize their motives and motivations, and let emotional aspects “go by the board’ [28]. 
Driving can thus be accompanied by feelings of relaxation and pleasure, excitement and 
elation, the joy of driving or of speed, but also by stress and tension. As a rule, car driving 
is associated with positive feelings [30-32]. 


The car as status symbol, symbolic motives and cultural symbolic meaning 
Alongside instrumental and affective motives, symbolic motives also influence the 
choosing of cars (or transport modes in general). In doing so, they fulfill two functions: 
First, a personal value may be expressed by using or owning a specific vehicle. Second, 
this may then underscore a certain position in the social order. A car may, for instance, 
signify status and prestige, or perhaps a particular attitude to life [28—30, 33, 34]. 

Furthermore, cars also serve as a cultural symbol. They represent progress, freedom, 
individuality, and sophistication. They inspire music, art, literature, film, and advertising. 
They have an impact on family life, social interaction, and cultural rituals, and are an 
integral component of initiation rites in modern society (see [11, 35-37]). 


Further approaches 

Beyond the not always clear-cut distinctions of instrumental, affective, and symbolic 
motives (for more on this, see [6, 38]), a number of recent studies and debates have placed 
cars and the reasons for using them more clearly in the context of a sociotechnical system. 
This research has thrown light on the way cars fulfill specific social functions: how, for 
instance, they perpetuate geographical inequalities and divisions, shape social construc- 
tions, or how they can fix national and cultural identities [14, 39-43]. 

A further important topic, in the context of our work on the interrelationship between 
car ownership and autonomous driving, is the car as “private space” (see [44, 45]). For 
some, the “cocoon” car, an “inhabited” space, can function as a refuge from what is felt to 
be stressful, hectic, loud, and overcrowded modern life. Moreover, it also holds special 
significance for social interaction. Laurier und Dant [46] have examined the significance 
of this “inhabited” space and the emergent increasing vehicle automation. They point out 
that liberation from the driving task fits in with cars’ evolutionary development over 
recent decades. This trend is far less a matter of expressing identity (as also manifested in 
sports cars’ loss of significance and the increase in closed vehicles with large interiors) 
than one of temporarily “inhabiting” a space that also enables social interaction. Such 
studies consistently stress that it is social factors, far more than individual ones, that can 
play a considerable role in the way cars are favored. Inside an automobile, people take on 
the same specific social roles that they assume in their other social interactions (being a 
parent, friend or worker, etc.) [42, 47]. 

In this context, newer studies on how people value their time spent travelling when 
using various transport modes could also be of use (see [27, 48]). For a long time, driving 
cars was viewed as unproductive, lost time—the frequently monotonous, unvarying way 
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to work was a typical example of this burden [49]. That time spent in a car is certainly 
subjectively perceived as valuable, however, and may even be viewed as a “gift,” has been 
recently demonstrated by Jain and Lyons [48] with their study on commuters. Travel times 
were here seen as time for relaxing from everyday hustle and bustle, a transition time 
between work and home. These findings are in line with an earlier work on commuting, in 
which Mokhtarian et al. (2001) were already able to show that time spent in a car is 
certainly not always seen as wasted [27]. 


31.2.2 Summary 


At present, car usage and ownership is approaching a saturation point in industrial nations, 
which is not to say that the car will fall from its dominant position so easily because of this 
[50]. For the vast majority of car users, it will far more likely retain its significance in 
fulfilling their daily needs ([51]: 114). What is of prime importance in the debate on the future 
uses of autonomous cars (and also their acceptance) is to take into consideration the com- 
plexity of instrumental, affective, and symbolic aspects. Technology’s perceived functional 
qualities can, at first glance, appear to be an easily measurable “objective” benefit, but these 
functional aspects only reveal their significance in the context of the subjective motivations 
—affective and symbolic—that accompany autonomous driving. Furthermore, embedding 
instrumental motives for (autonomous) car usage in the context of everyday praxis, and also 
of the relevant sociotechnical system, plays a role too. The autonomous vehicle may be 
perceived as safe, flexible, and comfortable, but this will only lead to it actually being used if 
safety, flexibility or comfort have a specific significance in daily praxis [51]. 


31.3 Multiple-Method Investigative Approaches 
for Autonomous Driving in the Context of Car Usage 
and Ownership 


The insights from research into car usage and ownership, together with the indications 
from the first exploratory study on autonomous driving, have formed the conceptual basis 
for our follow-up empirical work. The objective of these ongoing studies is to survey, in a 
use-oriented fashion, the specific attributes that road users currently ascribe to autonomous 
cars and, in the “translation” of such attributes, to decipher instrumental, affective and 
symbolic motives. The questions guiding the research are thus: What characteristics and 
assessments do road users associate with autonomous driving and autonomous vehicles? 
What various motives are decisive in this? The context of what attributes are currently 
ascribed to autonomous driving is also to be analyzed and, where possible, linked to how 
people live their daily lives and get around. In this way, it will then be possible to 
determine which attitudes and judgments may be expected to have an effect on acceptance 
of the technology. 
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To this end, a multiple-method procedure was selected. To explore potential variations 
in people’s perceptions and judgments, respondents were confronted with specific use 
cases of autonomous driving in a quantitative online survey. This survey also contained a 
free-text questionnaire—participants were thus able to ascribe autonomous driving with 
attributes in a completely individual way. A more in-depth analysis encompassing the 
context in which autonomous driving is presently perceived and viewed allowed for 
exploratory qualitative procedures to be pursued in parallel as part of group discussions. 
The focus here lay particularly on ambivalence in how technology is viewed (see 
Chap. 29), particularly in advance of potential implementation—with both fear and high 
expectations. Exploratory qualitative procedures appear to be especially apt for this still 
relatively young field of research. Until now, there has been barely any insight available 
into the attitudes and motives surrounding autonomous driving on the user side—the open 
character of such studies helps to decipher these motivations. 


31.3.1 Perception and Assessment of Autonomous Driving 
in Relation to Specific Use Cases 


It may also be expected that each of the four use cases developed in the course of this 
project (Chap. 2) will be perceived and assessed differently in view of their 
acceptance-relevant aspects. This is because they not only differ in technical terms, but 
also in the specific implications, usage areas, and attributes they are associated with (for 
more on this see Chaps. 6, 11, 12, and 32). In a quasi-representative survey, we therefore 
recorded differentiated attitudes to autonomous driving with recourse to the use cases. 
A thousand people were surveyed, and represented the total German population regarding 
gender, age, income, and level of education. An in-depth discussion of the survey—which 
was developed and carried out in cooperation with several authors of the present volume 
—and sampling can be found in Chap. 6. 

A total of 57 % of those surveyed declared they were generally interested in the topic 
of autonomous driving. However, 44 % stated they had no knowledge of the subject, and 
a mere 4 % termed themselves as being well informed or having specialist knowledge at 
all, let alone being an expert. 78 % obtain their information on the topic primarily from 
the mass media, 64 % go straight to experts, 56 % discuss it with friends or co-workers, 
and 40 % share and compare notes on social media. 

Following a general section with questions on sociodemographics, mobility behavior, 
travel requirements, etc. the respondents were each randomly allocated one of four sce- 
narios based on the use cases. Each scenario was introduced with a short description: 


Scenario for Interstate Pilot Using Driver for Extended Availability: On freeways or similar 
roadways, the driver can hand over control to the vehicle. The driver does not have to pay 
attention to other traffic or the driving task in this time, and can pursue other activities. 
Scenario for Autonomous Valet Parking: After all passengers have got out of the vehicle, it 
can drive itself to a pre-determined parking space and also from there to a pick-up address. 


31 Taking a Drive, Hitching a Ride: Autonomous Driving and Car Usage 671 


Scenario for Full Automation Using Driver for Extended Availability: Whenever and 
wherever desired or required, the driver can hand over control to the vehicle. The driver does 
not have to pay attention to other traffic or the driving task in this time, and can pursue other 
activities. 

Scenario for Vehicle on Demand: A vehicle on demand drives its passengers without the 
presence of any human driver. People themselves can no longer drive in such vehicles — the 
vehicle’s interior will thus also have neither steering wheel nor pedals. 


A follow-up question to each use case as it was introduced enquired whether the 
respondents would essentially be prepared to replace their till-now preferred transport 
mode with an autonomous vehicle. This question has had already been put to them in the 
same form in the first, general part of the survey, but there it was relatively unspecifically 
termed “an autonomous vehicle” with no further explanation. Altogether the respondents 
had relatively little desire to replace their own vehicle (or “favorite mode of transport”) 
with an autonomous vehicle—whether precisely specified or not. Only between 11 and 
15 % agreed to this statement in large or full measure (see Fig. 31.1). However, 27 % said 
they could hardly imagine, or could not imagine at all, replacing their preferred mode with 
a (non-specified) autonomous vehicle. When, as in the survey, autonomous driving is 
proposed in relation to a specific use case, this degree of refusal increases sharply, to 
between 44 and 54 %. This means that refusal becomes stronger with more precise 
scenario descriptions. The lowest acceptance, incidentally, is for Vehicle on Demand— 
54 % would not wish to replace their favored mode with it and only 11 % could envisage 
it at all. 

To explore what the respondents currently associate with autonomous vehicles, they 
were asked to declare in their own words, in up to fifteen free-text boxes, what they 
understand by the term “autonomous vehicle.” The short descriptions (see above) were 
also a basis here. The following analysis refers solely to the answers of those respondents 


In principle, | can imagine replacing my favorite mode of 
transport with an autonomous vehicle. 


Autonomous vehicle (non-specified) SS N) 


Vehicle with interstate pilot 


Fully automated vehicle BE u) 


Vehicle on Demand 


0% 20% 40% 60% 80% 100% 
E not atall true [I] predominantly not true rather not true 
M rather true Ml predominantly true [l absolutely true 


Fig. 31.1 Preparedness to replace the preferred means of transport with an autonomous vehicle 
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who had been allocated the “Full Automation Using Driver for Extended Availability” 
(referred to as “Fully automated vehicle” in the following) and “Vehicle on Demand” use 
cases. 

The answers of the 250 respondents were summarized and categorized by hand, then 
allotted specific connotations (see below). For “Fully automated vehicle” there were a 
total of 3750 entries; of these, 2587 (69 %) were invalid for various reasons because it was 
not possible to make out a reference to the question, for example. For Vehicle on Demand, 
there were also 3750 entries overall, of which 2512 (67 %) were unusable. Figure 31.2 
shows the distribution of statements with various connotations: positive, ambivalent, 
negative or without connotation—the invalid entries have already been taken out at this 
point, the percentages refer to the remaining mentions. 

While the majority of descriptions of Fully automated vehicle are positive, the same 
can only be said of 38 % of definitions applied to Vehicle on Demand. For these two use 
cases, 36 and 40 % of the statements respectively had negative connotations. A small 
portion of the perceptions (5 and 4 % respectively) were ambivalent, i.e. they could not 
clearly be connoted as positive or negative. 

Overall, the qualities that the respondents attributed, independently of one another, to 
each of the two scenarios turned out to be relatively similar. Many answer categories are 
both equivalent in meaning and similar in their percentage distribution. We shall turn next 


Fig. 31.2 Connotations 
regarding autonomous driving: 
fully automated vehicle and 
vehicle on 


Fully automated vehicle 


Ambivalent connotation 


Without connotation 9% 


Total: 1163 entries 


Vehicle on Demand 


Positive connotation ass) 35% 
Negative conotaton ill «x 


Ambivalent connotation Ea] 8% 


Without connotation ==4] 18% 


Total: 1236 entries 
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to some of the notable differences. We shall also examine the attributes given, where 
possible, for what instrumental, emotional, and symbolic characteristics are ascribed to 
autonomous vehicles. 


Full Automation Using Driver for Extended Availability 

In the “positive assessments” segment, 17 % of statements were in the category of 
“comfortable,” followed by “good” (13 %), “safe” (11 %), “relaxing” (10 %), and 
“modern” (10 %)—these proportions are given in Table 31.1. Among the “ambivalent 
assessments,” 8 % of the answers came in the “luxury” category, and 15 % of all 


Table 31.1 Answers in the description field “Fully automated vehicleis...”—summarized and 
categorized 

Positive in % Ambivalent in % Negative in % 
Comfortable 17 The future 48 Not for me 16 
Good 13 Utopian 23 Expensive 15 
Safe 11 Needs getting used to 22 Unnecessary 12 
Relaxing 10 Luxury 8 Weird 11 
Modern 10 Total: 106 100 Unsafe 11 
Practical Insufficiently 

9 9 

developed 
Brilliant 7 No valuation in % Boring 7 
Efficient 6 Autonomous 29 Technology 7 
dependent 

Interesting 5 No idea 20 Unpredictable 7 
For the mobility- Incomprehensible Dangerous 
; ; 4 18 3 
impaired statement 
Helpful Similar to other Terrible 

3 12 1 

transport modes 
Exciting 2 Not vehicles 11 Total: 422 100 
Environmentally A car 
3 2 6 

friendly 
Flexible 2 Comprehension 5 


questions 


Total: 533 100 Total: 102 100 
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“negative assessments” were because they viewed the scenarios as “expensive.” In this 
negative segment, only the answer category of “not for me” was more highly represented, 
at 16 %. “Luxury” was not once mentioned in connection with Vehicle on Demand, 
however, and, at 7 % of all statements, “expensive” only came in at seventh place. 

In the positive assessments segment, Fully automated vehicle was mainly associated 
with functional or instrumental aspects—vehicles such as these are described as “com- 
fortable,” “safe,” “practical,” “efficient,” “for the mobility-impaired,” “helpful,” “envi- 
ronmentally friendly,” 
although no-one deemed it “helpful.” Regarding Fully automated vehicle, only the pos- 
itive attributes of “relaxing,” “brilliant,” and “exciting” could be termed as emotional or 
affective. The same applies for Vehicle on Demand, though the relatively weaker con- 
notations of “great” and “good” categories were expressed instead of “brilliant.” As for 
the negative assessments, on the other hand, the distribution of functionally versus 
emotionally connoted aspects is reversed. “Weird,” “boring,” “dangerous,” and “terrible” 
are clearly affective categories (and are joined in the case of Vehicle on Demand by 
“scary”), while “expensive” and “insufficiently developed” denote more functional 
aspects. Answer categories that may be assumed to have a symbolic connotation are 
scarcely to be found among the statements. Statements in the “modern,” “interesting” or 
“luxury” categories most likely indicate that such autonomous vehicles are perceived and 
assessed in terms of aspects concerning the status manifested in the vehicles themselves. 


and “flexible.” Vehicle on Demand was also deemed “useful,” 


Vehicle on Demand 

The summarized and categorized attributes given for the Vehicle on Demand can be seen in 
percentage in Table 31.2. The top answer categories in the area of “positive assessments” 
hardly differ from those for Fully automated vehicle. Only in first place do we see a 
completely new category of “useful,” with 15 % of all statements made in this segment. 
After this, the respondents go on to describe the vehicle as “comfortable” (14 %), “re- 
laxing” (13 %), “modern” (12 %), and “safe” (10 %). Eighteen percent of statements made 
about Vehicle on Demand have no judgment attached to them. Half of these come under the 
“no idea” category—only 20 % of respondents, in comparison, declared they had “no idea” 
about Fully automated vehicle. Only 2 % of statements in the “no valuation” column were 
in the category of “similar to other transport modes,” whereas this applied to 12 % of those 
made about Fully automated vehicle. This category included entries such as “Fully auto- 
mated vehicle is ‘like the railroad’” or “Vehicle on Demand is ‘a taxi.’” 

A quarter of all negative statements on Vehicle on Demand fall under the highly 
emotionally cast categories of “scary” (10 %), “dangerous” (7 %), “weird” (6 %), and 
“terrible” (2 %). In contrast, not a single respondent found Fully automated vehicle to be 
“scary,” and only 15 % termed it “weird” (11 %), “dangerous” (11 %), or “terrible” (1 %). 
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31.3.1.1 Summary 

Overall the survey clearly demonstrates that Vehicle on Demand is the subject of the 
greatest number of negative and fewest positive assessments. Of the 250 respondents 
allocated to this use case, 54 % could not imagine replacing their currently preferred mode 
of transport with a Vehicle on Demand. In direct comparison with Full Automation Using 
Driver for Extended Availability, Vehicle on Demand is described with rather negative 
statements, with a quarter of all descriptions even viewing it as scary, dangerous, weird, or 
terrible. Clearly, this means that fewer respondents could imagine using a Vehicle on 
Demand than one they can still drive themselves, as is shown by the number of statements 
professing “no idea.” 


Table 31.2 Answers in the description field “A Vehicle on Demand is...”—summarized and 
categorized 
Positive in % Ambivalent in % Negative in % 
Useful 15 The future 41 Not for me 16 
Comfortable 14 Utopian 41 Technology 12 
dependent 
Relaxing 13 Needs getting used to 18 Unnecessary 11 
Modern 12 Total: 96 100 Scary 10 
Safe 10 Unsafe 10 
Great 9 No valuation in % Unpredictable 17 
Interesting 6 No idea 50 Expensive 7 
Efficient 5 Autonomous 22 Dangerous 7 
For the mobility- 4 Incomprehensible 17 Insufficiently 6 
impaired statement developed 
Good 4 Not vehicles 6 Weird 6 
Environmentally 4 A car 2 Boring 5 
friendly 
Good value 2 Similar to other transport 2 Terrible 2 
modes 
Exciting 2 Comprehension 1 Total: 493 100 
questions 


Total: 431 100 Total: 218 100 
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2 


The answer categories of “expensive” and “luxury,” which are either especially or 
exclusively attributed to Full Automation, indicate that such vehicles are still clearly 
linked with individual private ownership. Vehicle on Demand, on the other hand, is 
compared with other transport modes little or not at all. 

Classifying the statements on autonomous driving in terms of their instrumental, 
affective or symbolic aspects revealed that instrumental attributes predominate among 
positively connoted assessments. Strongly emotional statements, on the other hand, form 
the majority of negative accounts. Descriptions foregrounding the status character of 
autonomous vehicles, in contrast, were scarcely to be found. In the qualitative survey 
described in the following section, we shall take a closer look at the perceived negative 
aspects of autonomous driving, and ask which sociodemographic contexts they are 
embedded in. Such hostile attributes, in particular, are evidently strongly aligned with 
subject-related and affective issues as well as the context of car use and ownership, as the 
exploratory study has already shown (Chap. 29). 


31.3.2 Autonomous Driving in the Future: “Do We Really Want 
to Live Like That?”' 


The following findings are based on three group discussions in Berlin whose composition 
varied each time. All participants had a high level of education; some were in academia, 
studying or working at a university or other research institutes. The discussions involved 
five, six, and seven participants respectively. All those involved were living in Berlin, 
seven of them were women. The gap between oldest and youngest was greatest in the first 
discussion round, with the youngest 20 years of age, the oldest 50. All participants 
regularly used a car, though not all of them owned one. At the end of each discussion, data 
on sociodemographics, transport behavior, and car use and ownership were collected. All 
those taking part had already heard of autonomous driving before the discussion sessions. 

At the beginning of the session, the participants were given an illustrated narrative 
scenario of autonomous driving in the form of an A4 flyer. There were two different 
scenarios—one on “Full Automation Using Driver for Extended Availability,” the other 
on “Vehicle on Demand.” Each group was introduced to one of the scenarios, which they 
then considered within group-based introspection. The aim of this introspection is to make 
explicit the processes of “inward observation”, that is to say, to consciously direct con- 
centration and attention towards interior processes ([52]: 493, translation by the authors). 
Under the guidance of a research person, a group’s participants address the research object 
in question and document their own inner processes and experiences independently of one 
another. Finally, they share what they have found via self-observation with the group 
without commenting or passing judgment on each other’s accounts. In a second stage, the 


This question stems from a comment in the discussions described in this section. 
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group members—keen explore the topic further from hearing others’ experiences—add to 
their reports. Together with the scenario, the participants received the following 
instructions: 


You have just received a short description of a scenario involving the cars of the future — a 

short story on what the driving of tomorrow might look like. Please read the story carefully. 

Try to imagine yourself in what you read and think about your feelings, fantasies, and 

sensations — be open for anything and everything that crops up as you think about the topic! 
Please make notes on where your thoughts lead you. 


The participants then each read out their notes in turn, as a so-called “introspection 
report.” The reports are later transcribed and evaluated by means of qualitative heuristics. 
Unlike everyday procedures of discovery, which are frequently made unconsciously, 
qualitative heuristics is “rule-directed and supplied with a methodology,” and takes the 
form of systematized and intersubjectively traceable search-and-find procedures ([53]: 
226, translation by the authors). The method is based on four rules: 


1. Openness of the research person and subjects 
2. Openness of the research object 

3. Maximum structural variation of perspectives 
4. Analysis of commonalities. 


Furthermore, qualitative heuristics uses the so-called dialogic principle: A question is 
asked of an object (in the study, the transcribed introspection reports) which gives “an- 
swers.” New questions are then asked from another perspective, or a different angle, and 
so the process continues. The research object and research person are thus in close 
dialogic contact, which also serves to soften the strict division between (research) subject 
and (research) object. 

After producing introspection reports, the groups started open discussions, which were 
aligned on the implicit behavioral patterns (see [54]) in car usage and ownership. In now 
giving our results, however, we shall focus on what the participants conveyed in their 
introspection reports. 


31.3.3 Results 


The scenarios allocated to the group discussion participants stimulated great interest in the 
topic, but also critical questioning. In what follows, we shall describe some examples 
of topics that had already proved significant in the earlier, exploratory survey. 
The introspection reports show an ambivalent attitude to autonomous driving that is 
comparable to the results of the study given in Chap. 29. 

In addition, however, it became clearer which specific fears and worries relate to 
autonomous driving, and what social context it is seen in. We shall take a closer look at the 
range of hostility towards autonomous driving below—the results stem from both groups 
who were given the “Full Automation Using Driver for Extended Availability” scenario. 
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31.3.3.1 Skepticism About a Future with Autonomous Vehicles 

For the sake of completeness, it should be mentioned at this point that, in the scenario 
stories provided to the participants, the protagonist “Yvonne” used the time made free to 
her from not having to drive herself to pursue work activities (e.g. email correspondence), 
among other things. Although other activities were also covered alongside this, the story 
did tend to focus more on typical organizational activities (taking the kids to school, doing 
the shopping, etc.) than on leisure and relaxation pursuits (looking out the window, 
watching movies, sleeping/relaxing, etc.). It is therefore possible that skeptical and hostile 
attitudes on the part of (especially younger) group members towards autonomous driving 
could be down to the fact that life in the future was so clearly depicted as being full of 
structured and optimized everyday tasks. 

On the other hand, the qualities and attributes ascribed to autonomous driving by the 
participants can clearly be classified in terms of the earlier surveys, with the same 
ascriptions cropping up again and again in both the exploratory study and the quantitative 
questionnaire. 


The “accelerated service society” 

That it will in future be possible to spend time on other activities in an autonomous vehicle 
was largely viewed negatively in the discussions. In their orally read-out introspection 
reports, the participants expressed concern about no longer needing to concentrate on the 
driving task in future. This, they thought, could lead to private, leisure, and work activities 
becoming too closely mixed up with one another. Ultimately, this line of thought runs, 
technology may further a trend that many people today already identify as alarming: a 
society ever-more oriented towards performance and efficiency: 


2 


Johanna” “And private life and working life are mixing more and more and you become 
a total workaholic.” 
Timo “This strain of having to do more and more things in the same place at the 


same time is increasing.” 


The freedom and the opportunity to occupy oneself during the car journey in other ways 
may result in pressure to put this time in the service of efficiency. Having to concentrate 
while driving conventionally, on the other hand, was painted in a positive light: 


Johanna “That’s actually a nice thing about driving, that you have to concentrate on it in 
the moment and you also do something with your hands, and you precisely aren't 
already checking emails from work. That starts when you ’re sat at your desk.” 


?The names of the participants have been changed to protect their anonymity, and the quotes have 
been translated. 
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“This dependency on technology” 

One further consequence linked to autonomous driving is a future dependency on tech- 
nology, which may also entail an accompanying large degree of loss of control, which is 
viewed negatively. Technology dependence and loss of control are also seen as prob- 
lematic because there is skepticism as to the reliability of a technology over whose 
decisions one will no longer have any influence: 


Nico “In certain situations you can simply decide spontaneously, and you might 
actually have a much better feeling for it than the car.” 

Julian “And obviously it won't be possible to intervene immediately either if I first have 
to hear 5, 4, 3, 2, 1...beep.” 


Evidently, behind such worries lies a fundamental skepticism regarding technology, all 
the more so when it greatly impinges on individual safety, as in the case of autonomous 
driving: 


Julian “Not even my kettle gets my blind trust, why should I then blindly trust my car 
with my life? I somehow find that incredibly disconcerting.” 


Life is being “de-funned” and “you’ll get idle” 

The abolition of the driving task in autonomous vehicles is viewed highly critically. The 
main idea here is that a vehicle in which one does not drive oneself would curtail fun, 
spontaneity, individuality, flexibility, and control (it is interesting to note here that the 
participants had actually been given the Full Automation with Driver for Extended 
Availability story, where—as is described in the scenario—the driver can certainly still 
drive themselves whenever they like): 


Johanna “What is actually then the difference to public transportation? Because what I 
actually always appreciate about a car is that it is in my own hands—that I can 
judge for myself. And if I’m running a little late, then I can step on the gas alittle.” 


The “de-funning” (Timo) comment refers on the one hand very specifically to losing 
the fun of driving, but also to the lifestyle that could have the fun removed from it by 
autonomous driving: 


Bettina “You'll stop needing to move so much because you'll be able to get picked up by 
the car everywhere; you'll get lazy, you'll get idle, you'll only ever take the car, 
because it doesn’t matter if you’re feeling ill or how you are — you can take the 
car for every trip you make.” 


Social isolation: “Nobody needs anybody anymore”. 
The consequence of such “de-funning” and idleness is, in the view of the group members, 
that humans in the end will be replaced. “Nobody needs anybody anymore” (Inga), there 
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would then be a machine for everything and, in this way, even thinking would be done for 
you: 


Inga “The car drives, you no longer have to drive yourself. Food is delivered in one way 
or another, you cower a touch autistically in your apartment and grow dull, you 
don’t have to think anymore, you google or subject yourself to cat videos. So you 
basically become completely stupid.” 


System weaknesses: How truly “autonomous” are autonomous cars? 

Overall, trust in the safety of autonomous vehicles appears to still be on the low side. This 
leads the participants into wide-ranging speculation: “How predictable are these cars, 
then?” and, “What about when the system breaks down and there is no internet access?” 
(Nico), “Can they be driven remotely?” (Thorsten), “What happens when this system gets 
hacked?” and, “Can these autonomous cars really be autonomous?” (Bettina), “Just 
where, then, is the evidence that the whole thing is going to be safe?” (Herta). 

Behind such questions and statements, there is great insecurity regarding the 
still-unknown technology, and the possibility that dangers may accompany it. At the same 
time, the participants currently appear to be completely unclear as to who is behind the 
development of this technology and who is responsible for the system’s safety. Who 
would be liable in case of an accident? Who would accept the damages? And most 
important: Who would accept responsibility in the ethical sense? 


“Social and economic consequences” 

The examination of autonomous driving also turns up the worry that the technology will 
lead to job losses in various sectors (the automotive industry, taxi and delivery services, 
etc.). This is connected to the idea that autonomous vehicles will result in less variety 
across the spectrum of automobiles: “Jf you only have this large one” (Bettina), auton- 
omous driving would in the end be accompanied by “greater monopolization” (Eddie). 


31.3.4 Summary 


The issues raised in the group discussions concerning autonomous driving are embedded in 
a sociotechnological context that simultaneously uncovers negative and problem-centered 
ideas of society in future. Overall, the participants tend to take a hostile position vis-a-vis 
autonomous driving. Although positive aspects are also perceived, these are neither 
embedded in a specific usage context nor associated with positive ideas of future society— 
at least not to the same extent as the negative ones. 

Fears expressed in connection to a future with autonomous driving concern social 
isolation, social and economic consequences, over-reliance on technology, increasing 
idleness, and the pressure to keep up in a primarily performance-oriented society. 
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31.4 Conclusion 


The results from the quantitative questionnaire challenge the currently widespread 
assumption that autonomous driving can expect general openness and a high degree of 
acceptance (see [55-57]). Such openness is to be found in our study, but only when the 
question of what an autonomous vehicle is left unspecified. When the respondents are 
introduced to concrete use cases of autonomous driving, however, their assessments turn 
out to be far more negative. Assessments of Vehicle on Demand in particular suggest that 
some forms of autonomous driving are still relatively far away from people’s specific 
ideas of what a vehicle is, and also their ideas of how to get around. Among other things, 
the negative assessment arises from people feeling more “exposed” to potential risks and 
dangers that may arise in a Vehicle on Demand than they feel able to “control”, as they 
will no longer be able to control the vehicle themselves at all. Overall, it is currently 
debatable whether most people have any picture of what “autonomous driving” might 
mean. In the quantitative survey, 44 % of respondents still indicated they knew nothing 
about the subject, which clearly shows that awareness of it is far from penetrating all 
corners of society. These findings may also be taken as a sign that further studies more 
closely focused on the uses and applications of autonomous driving are required. 

Furthermore, the negative associations of autonomous driving and autonomous vehi- 
cles in particular indicate that a use-oriented examination must also address specific user 
groups. Scenarios to be worked with should, for instance, take even greater account of the 
different users’ living environments and systems of relevance. In this connection, it is at 
least clear that the level of trust placed in the still relatively unknown technology is on the 
low side—it is doubted that autonomous vehicles can be safe at all. At the same time, 
people currently have neither any specific idea what the technology is capable of nor who 
is behind its development and, in case of doubt, would accept responsibility for any 
potential damage, for example. 

The present remarks have primarily looked at people’s “subjective understanding” and 
reflexive or theoretical knowledge ([58]: 10 ff., [54]: 40 ff.) of autonomous driving and car 
use in general. The aim here was to trace how those acting deal reflexively with the topic, 
and thus also trace their motives, and then to ask: How is car use understood from a 
subjective perspective? What do people think about while using one? What intentions 
inform their behavior? This level of meaning forms the “orientation scheme” of the 
action-guiding knowledge structure. In future empirical work, it will also be necessary to 
decipher the orientation frameworks, i.e. the structure of action, and to ask how the praxis 
of car usage is produced in milieu- and culture-specific terms. 

Whether autonomous driving will provoke a fundamental transformation in the system 
of automobility can currently hardly be predicted—up to now there has been little sign 
that the hegemony of automobile usage is in serious danger. Nevertheless, in the end it 
may be precisely such a new technology as autonomous driving that sustainably and 
irreversibly transforms our transport system. As the sociologist John Urry puts it: “Just as 
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the internet and the mobile phone came from ‘nowhere’, so the tipping point here will 
emerge unpredictably, probably from a set of technologies or firms or governments not 
currently a center of the mobility industry and culture” ([59]: 272). 
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adaptation, distribution and reproduction in any medium or format, as long as you give appropriate credit 
to the original author(s) and the source, a link is provided to the Creative Commons license and any 
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Consumer Perceptions of Automated 3 2 
Driving Technologies: An Examination 
of Use Cases and Branding Strategies 


David M. Woisetschlager 


32.1 Introduction 


The automated, self-driving vehicle is one of the automobile industry’s major ventures in 
the 21st century, driven by rapid advances in information technology [10, 11]. Techno- 
logical innovations in the field of automated driving promise to contribute positively to the 
financial bottom line of automobile manufacturers [46]. Their integration as supplementary 
equipment increases the contribution margin of each car sold. In addition, automated 
mobility functions lay the foundations for new business models such as elaborated navi- 
gation services. While industry experts expect that it will take until the middle of the 21st 
century until fully automated cars will be available to the mass market [42, 45], automobile 
manufacturers have already begun to introduce supportive functions such as lane assistants 
and collision avoidance systems to the market [43, 50, 64, 66]. The promising market 
predictions suggest a general openness of customers towards using self-driving cars [51]. 
Besides automobile manufacturers and suppliers, technology firms such as Google are 
pinning their hopes on the predicted potential of automated driving technology [36, 37, 43]. 

The emergence of technology firms as competitors poses a threat to the established car 
manufacturers [58], as automated driving functions may require different organizational 
capabilities such as information technology, and faster innovation cycles, which are 
typically strengths of technology firms such as Apple or Google. Recent industry reports 
suggest that Google, as the new market entrant, is by far the brand associated most with 
self-driving cars [37]. Moreover, cars not yet in existence from technological firms receive 
similar levels of consideration in consumer surveys to those of established car manu- 
facturers [37]. Therefore, on the one hand, established car manufacturers are concerned 
about how their current market positions can be defended against potential new entrants. 
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On the other hand, cooperation with technological firms could help car manufacturers to 
differentiate their brands from their competitors’, especially if partnerships are selective or 
exclusive. Announcements of partnerships, such as the cooperation between Audi and 
Apple, point in this direction. 

At the same time, the role of branding as a critical success factor has been questioned in 
many instances. More precisely, the generally high relevance of brands in the context of 
cars has been recently put into question. Several studies suggest the diminishing role of 
automobiles relative to other products such as smartphones, at least for young customer 
segments [12]. The emergence and increasing popularity of access-based mobility systems 
such as car-sharing implies a trend towards a more utilitarian perspective on automobiles 
[57]. In contrast, some factors contributing to the high relevance of automobile brands 
remain relevant, irrespective of potential shifts in the preference hierarchy of product 
categories over time. This is because the relevance of a brand as influencing variable in a 
purchasing situation is generally seen as high when the purchase or use is associated with 
high levels of risk, information asymmetry, and symbolic value [34]. 

Existing literature provides comprehensive models for consumer goods, allowing an 
assessment of the relative importance of brands as predictor of purchasing behavior. In the 
particular context of high technology products, understanding of the role of brand 
knowledge is limited. Similarly, extensive knowledge exists about the effects of alter- 
native brand strategies such as brand extensions (e.g., new services) or brand alliances, 
e.g., [68], and how new product introductions influence the parent brand perception, e.g., 
[2]. However, an examination for high technology products such as automated driving 
technology does not exist. 

Against this background, this article contributes to the literature by developing a 
conceptual framework depicting relevant drivers of consumer acceptance and conse- 
quences of branding in the context of automated cars. Second, this article examines the 
relative importance of automobile manufacturer and technology brands for the acceptance 
of automated driving technology and services based on these technologies. Third, effects 
of the introduction of these technologies in a brand alliance are assessed. Fourth, the 
article conceptualizes how differing use-cases are perceived by potential customers. Based 
on the results of these empirical studies, implications for theory and management practice 
are derived. 


32.2 Theoretical Background 


32.2.1 Technology-Mediated Services, Service Robots, 
and Consumer Acceptance 


The emerging phenomenon of assisted and automated driving has been primarily studied 
from technological, legal, political, and ethical perspectives (e.g., [5, 7, 14, 26 —28, 30, 35, 
41, 48, 52, 55, 62]). Automated driving is defined as the shift of vehicle control from the 
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driver to the vehicle [63], while the extent of automation depends on the level of vehicle 
automation. The National Highway Traffic Safety Administration (NHTSA) has defined 
five levels of vehicle automation based on the proportion of driver vs. vehicle control. In its 
highest form, the vehicle performs all safety-critical driving functions and monitors 
roadway conditions for an entire trip, disengaging the driver from all duties [63]. The vision 
of fully automated driving in its highest form is seen as promising in terms of business 
potential, safety, and traffic management [21]. Consequently, automobile manufacturers 
and technological players such as Apple or Google are investing in the continuous progress 
of assisting and automated driving technologies. While this development seems to be 
promising from a consumer perspective on the one hand, literature also suggests that 
consumers hold strong objections against automated driving technology [25]. 

While relatively few research articles exist which explicitly focus on consumer per- 
ceptions of automated driving technologies (e.g., [51]), different contextual areas such as 
studies on self-service technologies, and service robots point at perceived benefits and 
problems that are associated with the shift of control from consumers to technology. 

Research on consumer acceptance of technology innovations is based on the tech- 
nology acceptance model and its subsequent modifications and generalizations [8, 15 — 
17, 47, 60, 65, 67]. Four distinct factors are conceptualized as antecedents of consumer 
acceptance and their subsequent behavior. The first antecedent, performance expectancy, 
refers to the perceived value of the technology. The second variable, effort expectancy, is 
defined as the degree of ease associated with the use of the system [65]. Third, social 
influences affecting individuals’ perceptions of subjective norms towards using the 
technology influence consumer acceptance and adoption of a new technology. Fourth, 
facilitating conditions such as infrastructure or support contribute to consumer acceptance. 
One of the most critical factors of consumer acceptance towards technology innovations 
and technology-mediated services is the perception of control. Even in smart-interactive or 
remote services which imply a limited and indirect human interaction, perceived loss of 
control has been found to be negatively related to consumer acceptance ([70, 71]). In 
addition, trust in technology-mediated services has been found to be critical, especially 
when the service is perceived as risky [69, 70]. To conclude, research on technology 
acceptance and technology-mediated services has identified the importance of perceived 
value, effort, social influences, facilitating conditions such as perceived behavioral control. 
Trust has been identified as a key prerequisite. 

In contrast to research on general technology acceptance and technology-mediated 
services, research on consumer perceptions of service robots is still at an early stage. The 
studied contexts predominantly focus on robots in smart home environments (e.g. [31, 49]) 
and healthcare appliances (e.g., [38]). Their research suggests that people prefer robots to 
act as trustworthy and controllable facilitators with a focus on interaction and cooperation 
rather than autonomously acting performers [23]. In a similar vein, research on robot 
companions suggests that people primarily see robots as assistants and serving machines 
with only a minority of the studied sample indicating that they would see them as peers or 
friends [18]. Research on robot companions recommends that the robot’s role, appearance 
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and behavior should be better matched to human requirements [9]. These findings point to 
the question of how an automated driving robot should relate to its human counterpart [54]. 

One central aspect of human-machine interaction is the perceived autonomy of the con- 
sumer [4, 29]. While the role of consumer autonomy has been addressed directly or indirectly 
by some studies, its criticality for consumer acceptance of automated technologies might not 
be fully captured in the contexts studied. Restricting or removing the autonomy of individuals 
could cause reactance, i.e., negative psychological and contrary behavioral responses of 
consumers as reactions to a perceived restriction of their personal freedoms [6, 44]. Auto- 
mated driving systems could be perceived as a threat to drivers’ autonomy, and reactance 
could arise in terms of consumer boycott intentions or low adoption rates. Presently, it is 
unclear if consumers are willing to accept a loss in control [56]. 

In the next section, findings of consumer-based studies on automated driving tech- 
nology will be briefly summarized. 


32.2.2 Research on Consumer Acceptance of Automated Driving 
Technology 


Only relatively few domain-specific studies exist which explicitly focus on consumer 
perceptions of automated driving systems. Because consumer knowledge of automated 
driving technology is sparse, a recent study analyzes reader comments to 15 distinct 
newspaper articles on automated driving in Germany and the US [25]. Their results 
provide evidence for the implied value propositions of flexibility and comfort, and 
comments relating to the safety and reliability of automated driving technology. The US 
comments in particular show negative responses relating to the restriction of freedom, 
pointing at the high relevance of consumer autonomy. 

A second study that focuses on the contexts of automated medical diagnosis systems 
and automated driving provides descriptive evidence for the important role of prominent 
brands as risk-reducing mechanism [13]. Four distinct scenarios of future mobility are 
developed in a study using a set of experts from car manufacturers, public authorities, 
scientists, and environmental groups [19]. Two of the four scenarios relate to automated 
driving and distinguish between privately owned and access-based (“shared”) automated 
vehicles. Both scenarios perform worse on the individualistic performance relative to the 
status quo, while performance advantages are seen on the systemic dimension. 

A first study quantifying the effects of psychological antecedents on usage and pur- 
chase intentions finds generally positive values for usage intentions among a sample of 
421 French consumers [51]. Their findings suggest significant positive influences of the 
general attitude towards automated driving, acceptability, and sensation (i.e., novelty) 
seeking on usage intentions. In addition, they find a gender effect revealing higher usage 
intentions for males. The latter effect is in line with existing literature on technology 
adoption, which generally finds male consumers to be more likely to be early adopters. 
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The present study attempts to build on these findings and conceptualizes a model which 
considers the key variables discussed in this section, the role of branding, and different use 
cases of automated driving. In the next chapter, the effects of brand equity, brand alli- 
ances, and different use cases on purchase intention are discussed. 


32.3 Conceptual Model 


32.3.1 Brand Equity, Acceptance Drivers and Purchase Intention 
of Automated Cars 


Brand equity (BE), defined as the added value endowed by the brand to the product [20], is 
regarded as an important concept for both business practice and academic research. 
Companies can gain competitive advantage through successful brands because they offer 
opportunity for differentiation, increased customer loyalty, and the possibility for charging 
price premiums [39]. Strong brands are characterized by measurable differences of what 
consumers know about these brands. According to Keller [33], consumer-based 
brand-knowledge consists of two dimensions, brand awareness and brand image. Brand 
awareness refers to the strength of a brand in memory, and the likelihood and ease with 
which the brand will be recognized or recalled under various conditions [59]. Brand image 
is defined as the perception of a brand as reflected by the brand associations held in 
consumer memory [33]. The favorability, strength, and uniqueness of brand image permit 
the brand to be strategically differentiated and positioned in the consumer’s mind. 

Brand equity has been found to be positively related to customer loyalty and will- 
ingness to pay. While strong brands are generally helpful for the marketing of products 
and services, the importance of brands has been found to vary across industry sectors, with 
a high relevance for the marketing of automobiles [22]. The relevance of branding 
strongly depends on the function of the brand as risk reducing factor, its function to 
enhance information efficiency, and its symbolic value. Since the purchase of a new car is 
an extensive decision involving comparably high expenditures and the collection of 
extensive information, strong brands can promote the purchasing process. 

Besides the sparse empirical evidence for the risk-reducing effects of strong brands in 
the context of automated driving [13], the aforementioned brand functions should be 
positively related to consumer acceptance of automated driving systems. Knowledge and 
experience of consumers with automated driving technology is marginal. In combination 
with additional cost for automated driving abilities, consumers are likely to evaluate a 
purchase decision as risky. Strong brands can effectively help to reduce perceptions of 
risk. 

In addition to a distinction between strong and weak automobile and tech-brands, 
introducing the respective automated driving system, several additional antecedents are 
considered in accordance to the aforementioned literature. More precisely, functional 
trust, the perceived convenience of the system, the price-value ratio, and the symbolic 
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value of the system explain why consumers feature high/low levels of purchase intentions. 
These factors are likely to be influenced by the consumers’ perceptions of safety and 
security of the system, the perceived autonomy, their privacy concerns [3], and brand 
attitude. 

To control for differences on a consumer level which are independent from the pre- 
sented scenario, the affinity of individuals towards adopting innovations, autonomy 
preference, and brand possession are considered below. 


32.3.2 Brand Alliances and Purchase Intention of Automated Cars 


Besides introducing automated driving systems under the brand of a single automobile 
manufacturer or tech-firm alone, brand alliances are another option to consider. Brand 
alliances have become more frequent in a wide variety of industries [40]. One of the most 
significant findings in brand alliance research is that an unknown or unfavorable brand can 
benefit from joining an alliance with a known and favorable brand [53, 61]. Brand 
alliances consist of at least two brand entities. Horizontal and vertical brand alliances can 
be distinguished [1]. Vertical brand allies play different roles in the value chain (e.g. Intel 
as the supplier and Dell as the manufacturer), whereas horizontal brand allies belong to the 
same industry or similar product category (e.g. Haagen-Dazs and Baileys). For the present 
study, a vertical brand alliance between, e.g., an automobile brand and a tech-company is 
proposed to be a realistic scenario, as more and more alliances between car manufacturers 
and tech-companies have been announced in the media [32, 37]. Differences in purchase 
intentions depending on the presence/absence of a brand alliance of a strong/weak 
automobile manufacturer brand with a strong tech-brand will be assessed. 


32.3.3 Use Cases of Automated Driving and Their Effects 
on Purchase Intention 


As mentioned above, the National Highway Traffic Safety Administration (NHTSA) dis- 
tinguishes five levels of vehicle automation based on the proportion of driver vs. vehicle 
control [63]. To assess potential differences in purchase intention, different use cases which 
are comparable to automated driving on the fourth level of full self-driving automation are 
considered. In detail, the first study exposes the subjects to Interstate Pilot with Extended 
Availability Through Driver. While the second study extends Study 1 by considering brand 
alliances, two additional use cases are introduced in Study 3. The second use case is 
Automated Valet Parking and reflects comparably lower levels of personal physical risk 
and lower levels of personal autonomy loss. The third use case is on the fifth level of the 
NHTSA typology and suspends the driver from driving. The vehicle is a Vehicle on 
Demand. It is expected that the third use case is evaluated most critically, as it could 
involve higher levels of personal physical risk and a restraint of personal autonomy. 
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32.4 Sample Description 


The proposed model is split into a series of three studies and tested via an online consumer 
survey among members of an online panel provider. The sample was selected based on the 
requirements of holding a valid driver license, possession of a car, and comparability in 
terms of gender and age according to the German population between 18 and 70. Prior to 
the manipulation, respondents were asked to name the brand and model of the car that they 
would use primarily. In addition, they were questioned about their involvement in cars in 
general and had to indicate their familiarity with and attitude towards the brand(s) used in 
the respective scenario. Each subject was then randomly assigned and confronted with only 
one scenario. An Interstate Pilot was featured as automated driving system in the first two 
studies. Study three explicitly examines how consumers perceive alternative use cases 
(Automated Valet Parking, Vehicle on Demand). After exposure to one of the scenarios, 
respondents were asked to indicate their purchase intention for the optional automated 
driving system. Next they were asked to rate several factors that were hypothesized to be 
either positively or negatively related to their intention to consider the Interstate Pilot on 
offer. The survey concluded with manipulation checks, a self-assessment of the respon- 
dents driving capabilities, stress perception, subjective feelings about safety in traffic, and 
socio-economic characteristics of the respondents. The final sample contains 545 
responses. 55.2 % of the respondents are male, the average age of the respondents is 42.83 
(standard deviation (SD) = 12.62). 


32.5 Study 1 
32.5.1 Study Design, Data Collection, and Measures 


The first study attempts to test the effects of brand equity on consumer acceptance using a 
laboratory experimental design, in which we asked respondents to read a fictitious press 
release indicating the announcement of Interstate Pilot Using Driver for Extended 
Availability. In order to isolate potential effects of brand equity differences (i.e., strong vs. 
weak brands) and potential differences in credibility of the actors (i.e., automobile firms 
vs. new market entrants), different press releases for different players were designed. 
A 2 x 2 between-subjects experimental design was constructed in which the different 
scenarios only differ in terms of the selected brand, while everything else is held constant. 
Figure 32.1 shows the press release used in the first study. 

In total, 239 respondents took part in Survey 1. The participants are roughly equally 
distributed across the two additional scenarios. Cell-sizes ranged from 49 to 65 respondents 
and no differences in age and gender distribution were found across cells. To test if the 
manipulations of different levels of brand equity and competence of the industry actors 
were perceived differently by the respondents, manipulation checks were conducted. To 
examine if the respondents perceived the brands differently, brand attitude was measured as 
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| News | Automobile Sector | Newsflash | 

June 8th 2014 

09:45 MESZ 

[Brand] presents automated driving on highways — market launch by the middle of 2015 


Berlin (dpa). As [brand] announced today, an optional module named ADX (“Automated Driving 
Experience”) will be offered in the course of the yearly car updates by the middle of 2015. The module will 
be offered for all car models of [brand] and allows fully automated driving on all German highways. 


The driver can activate the ADX system on the highway with a simple push of a button. The ADX is linked to 
the navigation system and takes over any preset target. All driving functions will be taken over by ADX at a 
manually adjustable speed up to 160 km/h. “The driver becomes a passenger and can use the time to 
relax or for work,” said Herbert Mueller, chairman of [brand]. Nevertheless, the driver can intervene at any 
time and take-over the control from the system. Prior to reaching the last exit before the target 
destination, an acoustic signal indicates the driver to take over control. The engineers of [brand] have also 
thought about the fact that drivers could fall asleep. If no reaction is monitored by the system after 
prompting twice, the car will pass the exit and drive automatically to the next rest area, where the car will 
be safely parked. 


ADX will be available by the middle of 2015 as optional component for all car models of [brand] for a price 
of €3,500. “By introducing automated driving on highways, [brand] provides a valuable contribution to the 
increase of safety on German streets,” the car-manager pointed out. 


Fig. 32.1 Fictitious press release used in Study 1. Image rights belong to the author 


the manipulation check variable. Brand attitude reflects the favorability and strength of 
brand associations, one of the two dimensions of brand equity. As automobile brands 
generally perform well in brand awareness (recall or recognition) scores, brand attitude is a 
more reliable variable to measure differences in brand equity. Brand attitude was measured 
with three items, capturing the favorability, likability, and performance of the brand. 
Results reveal significant differences between the strong (mean value (MV) = 5.40; 
SD = 1.44) and weak (MV = 4.55; SD = 1.55) car manufacturer brands (p < 0.05) and the 
strong (MV = 5.54; SD = 0.99) and weak (MV = 3.75; SD = 1.79) technology brands 
(p < 0.01). In addition to the manipulations, brand possession and differences in individual 
innovativeness were included as co-variables. The dependent variable purchase intention 
was measured with three items indicating each individual’s likelihood to purchase/consider 
a car with the particular brand and Interstate Pilot (for the indicated price of €3500). The 
price was set in analogy to current prices for combined systems for assisted driving. The 
scale displays excellent reliability (Cronbach’s a = 0.94). 

To explain the reasons for varying levels of purchase intentions, several proposed 
drivers and barriers were measured on a perceptual level. Respondents were asked to 
evaluate the proposed value of the system (i.e., convenience). In addition, functional trust, 
price/value ratio, and prestige were included as mediators. These mediators are influenced 
by autonomy perceptions, autonomy preference, privacy concerns, safety and security 
perceptions, and brand attitude. The model also controls for brand possession and if 
respondents considered themselves to be early or late adopters of innovations. The results 
of the confirmatory factor analyses (CFA) suggest valid and reliable scales. In addition, 
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the discriminant validity of the constructs was assessed [24]. The average variance 
extracted (AVE) for each construct exceeds the shared variance with all other constructs. 
Hence, we conclude sufficient reliability and validity for the measures in this study. The 
measurement properties and scale items are available upon request. 


32.5.2 Results 


On average, intentions to purchase the optional Interstate Pilot Using Driver for Extended 
Availability are evaluated to be modest (MV = 3.30; SD = 1.81), a finding which in line 
with generally high skepticism towards the adoption of innovations. From the 239 
respondents who were confronted with one of the four scenarios, a total of 17.2 % 
indicates high or very high intentions to purchase the featured automated driving system. 
However, more than a third of the respondents (39.1 %) of the sample replied that they 
would be (highly) unlikely to adopt this system in the near future. These findings indicate 
that there is a significantly sized market segment of early adopters but reveals acceptance 
problems at the same time. Therefore, the next step assesses whether these findings differ 
depending on the provider’s brand equity and industry sector. 

An analysis of variance (ANOVA) was conducted to test the hypothesized effects. 
The ANOVA results show a significant main effect for brand equity (p < 0.01), and 
non-significant effects for the industry sector of the firm (i.e., automobile manufacturer vs. 
tech company) and the interaction term. In addition, differences in individuals’ general 
innovation affinity and car possession significantly explain differences in the observed 
levels of purchase intention. The effects of the manipulations on purchase intention are 
displayed in Fig. 32.2. 

The findings indicate that purchase intention is influenced by brand equity, irrespective 
of the affiliation of the respective company to the sector of automobile manufacturers or 
tech-companies. The values for the strong automobile brand (MV = 3.67; SD = 1.91) and 
the strong tech-brand (MV = 3.63; SD = 1.70) are on a similar level. In a similar vein, the 
difference in purchase intentions for the comparably weaker automobile brand 
(MV = 3.01; SD = 1.81) and the weaker tech brand (MV = 2.88; SD = 1.82) is 
insignificant as well. 

To shed light on the relative impact of antecedents of purchase intention, a structural 
equation model was estimated. The results reveal that functional trust is the most relevant 
driver of purchase intention (B = 0.432; p < 0.01), followed by the perceived convenience 
of the described interstate pilot (8 = 0.237, p < 0.01). The other mediators are significant, 
but less important (price-value ratio 8 = 0.124, p < 0.05; symbolic value B = 0.117, 
p < 0.05; and general innovation affinity B = 0.169, p < 0.01). In total 67.9 % in variance 
of purchase intention are explained. 

Functional trust is significantly and positively influenced by safety and security per- 
ceptions (B = 0.383, p < 0.01), perceived autonomy (B = 0.327, p < 0.01), general 
innovation affinity (B = 0.163, p < 0.01), and brand attitude (B = 0.130, p < 0.01). 
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Fig. 32.2 Purchase intention for Interstate Pilot offered by different brands. Bildrechte: 
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Autonomy preference is significantly negatively related to purchase intention (8 = —0.138, 
p < 0.01). Contrary to expectations, differences in privacy concerns are not significantly 
related to purchase intention (ß = 0.012, p > 0.1). These factors explain a total of 71.8 % in 
variance of functional trust. The key value proposition of Interstate Pilot is positively 
affected by respondents’ perceptions of autonomy (8 = 0.598, p < 0.01), and negatively by 
autonomy preference (8 = —0.298, p < 0.01). Brand attitude (B = 0.238, p < 0.01) is 
positively related to convenience perception, while all other factors remain insignificant. 
The antecedents explain 63.3 % in variance of convenience. Similarly, the price-value 
ratio is strongly affected by autonomy (8 = 0.450, p < 0.01) and autonomy preference 
(B = -0.122, p < 0.05). Moreover, innovation-oriented consumers evaluate the price-value 
ratio more favorably (ß = 0.241, p < 0.01). Brand attitude is also positively related to 
price-value perceptions (8 = 0.131, p < 0.05). A total of 42.8 % in variance of price-value 
ratio are explained by the model. Symbolic value is significantly affected by differences in 
brand attitude (B = 0.575, p < 0.01), explaining a total of 33.1 % in variance. 

The results of the first study offer relevant insights into the drivers of purchase intention 
of Interstate Pilot Using Driver for Extended Availability. Prior to convenience, functional 
trust is seen as the most critical factor affecting consideration of the system. Besides 
promoting the central value proposition (i.e., convenience value), marketing managers 
should emphasize the perceptions of safety, security, and autonomy, since these variables 
are indirectly related to the key outcome variable, purchase intention. Strong brands can 
promote the adoption of automated driving on highways, as differences in brand attitude 
are positively related to symbolic value, price-value perceptions, convenience, and 
functional trust. As shown above, the respondents were not found to distinguish between 
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automobile and tech-brands in general, but rather between strong and weak brands. 
Hence, strong tech-brands like Apple or Google can significantly endanger the position of 
established manufacturers, especially those with weak brands. Therefore, Study 2 analyzes 
if a weak (strong) automobile brand can benefit from joining a brand alliance with a strong 
tech brand. 


32.6 Study 2 
32.6.1 Study Design, Data Collection, and Measures 


The second study attempts to test if consumer acceptance is different when the automated 
driving system on offer is branded by the OEM and a technology partner, constituting a 
brand-alliance. The brand alliance settings are compared to the results of the single-brand 
strategies documented in Study 1. Similarly to Study 1, each respondent was exposed to 
one of the two additional scenarios, in which we asked respondents to read a fictitious 
press release indicating the announcement of an Interstate Pilot Using Driver for Extended 
Availability. The press release was modified by adding the second brand name into the 
header and by integrating both brand names into the text. 

The proposed model was tested via an online consumer survey among members of an 
online panel provider. The same sample selection criteria were used as documented in 
Study 1 above and the survey had the identical structure. 

In addition to the participants in the first study, 92 respondents took part in the survey 
for Study 2. The participants were distributed roughly equally across the two additional 
scenarios. Cell-sizes ranged from 45 to 47 respondents and no differences in age and 
gender distribution were found across cells. Manipulation checks of brand attitude reveal 
significant differences (p < 0.01) between the strong automobile brand (MV = 5.35; 
SD = 1.62) and the weak automobile brand (MV = 4.74; SD = 1.49). In addition, the tech 
brand used in the brand-alliance scenarios is evaluated significantly better than the weak 
automobile brand, whereas the difference to the strong automobile brand is insignificant 
(MV = 5.50; SD = 1.01). 

Similarly to Study 1, purchase intention was measured with three items and the same 
co-variables were included. The structural model was also replicated in order to identify 
possible explanatory variables for the observed differences in purchase intention. The 
measurement properties suggest valid and reliable scales. 


32.6.2 Results 


An analysis of variance (ANOVA) was conducted to test the hypothesized effects. 
The ANOVA results show a significant main effect for co-branding (p < 0.01), and a 
significant effect of innovation affinity on purchase intention. The results show a 
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significant negative effect of co-branding on purchase intention. The dependent variable 
drops from 3.67 to 2.67 (SD = 1.93) for the strong car brand, and from 3.01 to 2.78 
(SD = 1.80) for the weak car brand. With regard to the results of the manipulation check, 
these findings are against expectations. At least for the weak car-brand, positive sup- 
porting effects of being linked to a more attractive tech-brand would have been plausible. 
To analyze potential explanations for the observed effects, a structural equation model was 
estimated. The results exhibit significant differences to the model reported in Study 1. In 
detail, functional trust plays an even more important role for purchase intention in the case 
of a brand alliance between an automobile brand and a tech brand (B = 0.747, p < 0.01). 
Price-value ratio also shows a significant effect on purchase intention (8 = 0.180, 
p < 0.01), while all other remaining direct effects are insignificant. In addition, the impact 
of safety and security perceptions on functional trust is larger in the brand-alliance setting 
(8 = 0.550, p < 0.01). Autonomy perceptions also have a significant but comparably 
smaller effect on functional trust (B = 0.208, p < 0.05). 

These findings suggest that consumers’ evaluations of the automated driving system 
are not improved by a co-branding strategy with a tech brand, which is evaluated similarly 
or better relatively to the automobile brand. Rather, consumers form their purchase 
intention based on the trustworthiness of the system, which is mainly influenced by their 
safety and security concerns and the perception of autonomy. In the case of the strong car 
brand, the safety and security of the automated driving system are evaluated significantly 
more negatively (p < 0.05) in a brand alliance with a tech brand (MV = 4.15; SD = 1.82) 
relative to a single-brand strategy (MV = 4.94; SD = 1.65). For the weak car brand, this 
effect is insignificant. Overall, the findings of Study 2 indicate that automobile manu- 
facturers and technology firms such as Apple or Google need to emphasize the specific 
benefits of potential brand alliances. Consumers perceive such partnerships as riskier and 
functional trust becomes a prerequisite of the adoption of automated driving systems. 

In order to test the generalizability of these findings, Study 3 replicates Study 2 using 
two alternative use cases of automated driving. 


32.7 Study 3 
32.7.1 Study Design, Data Collection, and Measures 


The third study attempts to measure differential effects of alternative scenarios of auto- 
mated driving, each branded with a weak or strong brand. In addition to the Interstate Pilot 
Using Driver for Extended Availability used as stimulus in the first and second study, two 
scenarios reflecting low personal risk (Autonomous Valet Parking) and high personal risk 
(Vehicle on Demand) were designed. Table 32.1 shows the press releases used in the third 
study. 

A strong and a weak OEM-brand were both used as single brands, constituting two 
scenarios for each additional use-case. Similarly to studies 1 and 2, each respondent was 
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Table 32.1 Use case descriptions utilized in Study 3 


Use case 2: fully automated vehicle, low 
personal risk (Autonomous Valet Parking) 


[Brand] presents fully automated parking— 
market launch by the middle of 2015 


Berlin (dpa). As [brand] announced today, an 
optional module named APT (“Automated 
Parking Technology”) will be offered in the 
course of the yearly car updates by the middle 
of 2015. The module will be offered for all car 
models of [brand] and allows fully automated 
parking 

The driver can simply leave the car at the 
target destination and activate the APT system 
via smartphone. APT will independently 
search for a parking space at no charge within 
a radius of 5 km. All driving functions will be 
taken over by APT at a manually adjustable 
speed of up to 30 km/h. “Drivers can directly 
reach their targets in city centers, the car takes 
care of the parking task,” said Herbert Mueller, 
chairman of [brand]. After a business 
appointment or a visit to a theater, the car can 
be activated and ordered to any location via 
smartphone. The car remains locked for third 
parties throughout the process, with the 
exemption of the Police 


APT will be available by the middle of 2015 
as an optional component for all car models 
of [brand] for a price of €3500. “By 
introducing fully automated parking, [brand] 
provides a valuable contribution to stress 
reduction when searching for scarce parking 
spaces,” the car manager pointed out 


Use case 3: fully automated vehicle, high 
personal risk (Vehicle on Demand) 


[Brand] presents fully automated driving— 
market launch by the middle of 2015 


Berlin (dpa). As [brand] announced today, an 
optional module named ADR (“Automated 
Driving Robot”) will be offered in the course 
of the yearly car updates by the middle of 
2015. The module will be offered for all car 
models of [brand] and allows fully automated 
driving on all German streets 


The communication between passenger and 
car is realized by the navigation system. After 
entering the target destination, the car is 
moved automatically by the system, allowing 
no steering actions by the passenger. Only the 
target destination can be modified and an 
emergency stop function allows a safe stop 
and exit. All driving functions will be taken 
over by ADX at a manually adjustable 
speed of up to 160 km/h. “The driver 
becomes a passenger and can use the time to 
relax or for work,” said Herbert Mueller, 
chairman of [brand]. “Our research has shown 
that driving robots react more reliably in 
dangerous situations than human drivers,” 
Müller continued. Especially after a period of 
inactivity, the danger of overreacting 
passengers would be high, therefore [brand] 
would consequently rely on fully automated 
driving. Nevertheless, the engineers of 
[brand] have also thought about emergency 
situations. Passengers can intervene at any 
time. The ADR will then approach a secure 
stopping point 

ADR will be available by the middle of 2015 
as an optional component for all car models 
of [brand] for a price of €3500. “By 
introducing fully automated driving, [brand] 
provides a valuable contribution to the 
increase of safety on German streets,” the car 
manager pointed out 


exposed to one of the four additional scenarios, in which the respondents were asked to 
read a fictitious press release indicating the announcement of Autonomous Valet Parking 


or Vehicle on Demand. 
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The proposed model was tested via an online consumer survey among members of an 
online panel provider. The same sample selection criteria were used as documented in 
Studies 1 and 2 and the survey had the identical structure. 

In total, 342 respondents constitute the sample for the third study. The participants are 
roughly equally distributed across the six scenarios (three use cases * strong/weak brand). 
Cell-sizes ranged from 49 to 65 respondents and no differences in age and gender dis- 
tribution were found across cells. In accordance to the prior studies, purchase intention 
was measured with three items and the same co-variables were included. The structural 
model was also replicated in order to identify possible explanatory variables for the 
observed differences in purchase intention. The measurement properties suggest valid and 
reliable scales. 


32.7.2 Results 


The two additional use cases are perceived slightly differently relative to the Interstate 
Pilot Using Driver for Extended Availability used in the studies 1 and 2. On average, the 
intention to purchase a fully automated parking assistant is about similar (MV = 3.59; 
SD = 1.93), whereas the fully automated driving robot receives significantly lower 
evaluations (MV = 2.97; SD = 1.83). A share of 18.6 % of the 113 respondents who were 
asked to evaluate the fully automated parking assistant indicates very high or high 
intentions to purchase the system. This is slightly higher than the 17.2 % of the 
respondents which indicated a (very) high likelihood to purchase Interstate Pilot as fea- 
tured in Study 1. The share of 38.9 % of the respondents stating that they are (very) likely 
to refuse to buy the featured automated parking assistant is on the same level as the share 
of skeptics in Study 1. As the comparison of the mean values of purchase intentions 
already suggests, the share of respondents with (very) high intentions to purchase a fully 
automated driving robot is much lower (10.9 %). Nearly half of the sample of 101 
respondents stated that they are (highly) unlikely to purchase the featured system in the 
near future. These findings point to differences in purchase intentions caused by the 
different use cases. In a next step, the effects of the use case and of brand equity are 
assessed in an ANOVA. The results reveal a significant main effect of use case (p < 0.05), 
while the main effects of brand equity and the interaction term remain insignificant. 

To analyze potential explanations for the observed differences, a multi-group structural 
equation model was estimated. The results exhibit significant differences of the model 
depending on the respective use case. More specifically, the relative importance of 
functional trust (ß = 0.170, p < 0.1) and prestige (8 = 0.08, p > 0.1) are much lower or 
insignificant in case of a fully automated parking assistant. The effect of price-value ratio 
is slightly higher (8 = 0.146, p < 0.1) and innovation affinity is much less relevant 
(8 = 0.122, p < 0.1). The most relevant driver of purchase intention is perceived con- 
venience (ß = 0.445, p < 0.01). The formation of functional trust, however, depends more 
strongly on the evaluation of safety and security (8 = 0.469, p < 0.01) and autonomy 
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preference (B = —0.165, p < 0.1), whereas all other antecedents remain at comparable 
effect sizes. In addition, the evaluation of convenience as a central value proposition 
depends more strongly on whether respondents value the autonomy obtained from 
automated parking (8 = 0.640, p < 0.01) and if their general autonomy preference is high 
(B = —0.436, p < 0.01). In sum, the successful introduction of a fully automated parking 
assistant primarily depends on a suitable communication of its convenience value. In 
comparison to the other use cases, functional concerns play a less important role. 

The intention to buy a fully automated driving robot depends strongly on functional 
trust (B = 0.477, p < 0.01). Furthermore, the perceived symbolic value is a more relevant 
antecedent of purchase intention ( = 0.254, p < 0.05), relative to the other two use cases. 
The perception of convenience and the remaining antecedents are less relevant. The 
evaluation of functional trust is formed differently than in the other two use cases. While 
safety and security concerns show a weaker influence on functional trust (B = 0.256, 
p < 0.05), perceptions of autonomy (B = 0.447, p < 0.01) and autonomy preference 
(B = —0.260, p < 0.01) reveal strong effects. The formation of convenience perceptions is 
by far less dependent on the perception of autonomy (B = 0.380, p < 0.01), but relies 
significantly more on autonomy preferences (B = —0.394, p < 0.01). The results indicate 
strong self-selection effects, as consumers preferring high degrees of autonomy will 
refrain from purchasing a fully automated driving robot. In light of the low level of 
purchase intention, this scenario appears to be unattractive for most respondents. 


32.8 Discussion and Future Research 


The results obtained from the three experimental studies offer valuable insights into 
drivers of individuals’ purchase intention of automated cars. In contrast to the generally 
positive values for usage intentions reported in a French study [51], the present analysis 
reveals that Germans are—on average— quite skeptical towards automated driving tech- 
nologies. As the two studies differ considerably in terms of the methodology applied and 
the amount of information given to the respondents, an interpretation of differences on a 
national level is not possible. However, every sixth respondent indicates very high or high 
intentions to purchase Interstate Pilot or Autonomous Valet Parking, irrespective of the 
limited information available. Every tenth person even considers high purchase intentions 
for fully automated driving robots (vehicle on Demand) which were said to exclude the 
passenger from any driving operations. These figures are comparable to other consumer 
studies measuring consideration values for technology innovations before market intro- 
duction. If the described systems are perceived as useful and reliable after their intro- 
duction, acceptance figures are expected to rise over time. 

Irrespective of the psychological value dimensions influencing purchase consideration 
levels, differences in the general innovation affinity partially explain why consumers 
consider purchasing the featured automated driving systems. In addition, respondents with 
high levels of autonomy preference react more negatively towards this technology. 
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Besides autonomy preference, differences in autonomy perception resulting from the use 
cases also account for the observed variance in purchase intention. Providers of automated 
cars must therefore carefully segment their target markets and keep non-automated car 
offers for the conservative segments. 

The remaining findings of the three studies and the resulting conclusions are sum- 
marized in Table 32.2. 

The present study also has several limitations, which can be seen as a venue for future 
research. First, the empirical study was conducted based on a representative sample of the 
German population according to age and gender distribution. However, respondents were 
asked to indicate their purchase intention not relating to their currently owned car brand. 
Instead, they were asked to state their purchase intention towards a specific offer of a 
brand. Potential differences caused by brand possession and brand attitude were controlled 
in the model. Nevertheless, future research should attempt to focus on specific car seg- 
ments with the corresponding target group to obtain more realistic results. Second, the 
nature of the laboratory experiment implies high levels of internal validity, but limited 
external validity. Future studies should strive towards a more realistic and vivid com- 
munication of the nature of automated driving, e.g., by using video stimuli rather than 
press releases employed in the present article. Third, future research should study how 
critical incidents resulting from automated driving are perceived by consumers and how 
their perceptions interrelate with the involved brand. Fourth, the study should be repli- 
cated in other settings (i.e., countries) to explore its boundary conditions. 


Table 32.2 Summary of results and conclusions 


Scope of analysis Results Implications 
Brand equity and e Brand equity is positively related + Strong technology brands could 
firm sector to purchase intentions, reveal similar acceptance levels 
irrespective of the firms’ and are therefore a threat to 
industry sector existing automobile brands 
Vertical brand e Negative perception of brand « Functional trust is a core brand 
alliances alliances asset of automobile brands 
e Functional trust, which is mainly + Safety and security concerns 
influenced by safety and security related to tech partners must be 
concerns, explains the negative solved prior to engaging in brand 
evaluation of vertical brand alliances 
alliances 


Use case differences Consideration: 17.2 %, mainly Reliability concerns and the 


+ Interstate Pilot with driven by functional trust and perceptions of usefulness need 
Extended convenience (case 1) to be addressed 
Availability e Consideration: 18.6 %, e Communication of benefits 
Through Driver mainly influenced by derived from the system 

e Automated Valet convenience (case 2) e Reliability and security concerns 
Parking e Consideration: 10.9 %, primarily are the main barriers, 

e Vehicle on Demand affected by functional trust and communication of symbolic 


symbolic value (case 3) benefits suggested 
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